fix(security): cap POST compatibility arrays and harden safeHtml links (#3607)

* fix(security): harden post compatibility and safe links

Cap POST-to-GET array expansion per body key before compatibility routing builds large query strings. Also normalize safeHtml blank-target anchor rel values so sanitized HTML cannot preserve opener access.

* fix(gateway): require bounded content length for POST fallback

* fix(gateway): emit malformed_request for oversized POST→GET arrays

Distinguishes the new 200-per-key cap rejection from happy-path traffic
in usage metrics. Sibling client-error fall-throughs (404/405/400) still
use 'ok' — only the cap response, which an attacker can reliably trigger,
gets its own RequestReason variant so it's filterable in dashboards.

---------

Co-authored-by: Elie Habib <elie.habib@gmail.com>