fix(security): bound structured input validation

[fishmingyu]

Summary

Bound structured input validation before large allocations and reject credential-bearing URL authorities without introducing input-size-dependent parser gaps.

These two self-contained hardening commits were extracted from the later #590 storage stack because they do not depend on #586–#588.

Changes

• validate JSON reader block type and size before buffering
• enforce lexical node, depth, token, item, and element budgets before DOM decoding
• use linear escape-dense string scanning and retain post-decode complexity validation
• reject URL userinfo after authority whitespace for standalone and protocol-relative URLs
• keep embedded prose URLs bounded at whitespace so later email addresses are not misclassified
• align the short and long URL paths with urlsplit leading WHATWG C0 handling
• validate the standalone scheme prefix once so repeated embedded separators remain linear
• add malformed-input, boundary, bounded-memory, scaling, and credential regressions

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally
• Added new tests for the changes
• pytest -q test/test_bounded_json.py test/storage/test_models.py --tb=short: 77 passed
• independent secret-classifier audit: 50 passed
• Python 3.10/3.11/3.12 checks across the 8,192/8,193 boundary and leading U+0000..U+0020
• randomized malformed/valid differential checks and 100k/200k/400k linearity probes
• pre-commit run --files codenib/_bounded_json.py codenib/_secret_fields.py test/test_bounded_json.py test/storage/test_models.py: passed
• git diff --check origin/main...HEAD: passed

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of the code
• I have commented the code, particularly in hard-to-understand areas
• The changes generate no new warnings
• Any dependent changes have been merged and published