Emit a length-aware base64url pattern in toJSONSchema (#6527)

* fix: emit a length-aware base64url pattern in toJSONSchema

z.base64url() rejects strings whose length is 1 (mod 4) — no encoder can produce them — but def.pattern held a charset-only regex, so toJSONSchema emitted a pattern that accepts input parse rejects. regexes.base64url is now strict, mirroring regexes.base64, and isValidBase64URL keeps a flat charset test since the quantified form overflows the regex stack on multi-MB input. Parse behavior is unchanged.

Fixes #6516

* fix: label the base64url section banner correctly