Hardening: input validation and bounds checking across 12 subsystems (round 8) (#31559)

Tightens input validation, bounds checking, and pointer/lifetime
handling across the package manager, node:http/http2, the debug adapter,
the V8 shim, S3, and path/fs internals. Continuation of #31417 and
#31495 (rounds 6–7); same structure — small per-area commits with
regression tests included.

### Package manager / build
- install: validate dependency-alias-derived names at the remaining
cache-index call site; validate git/github resolved values when loading
`bun.lockb` (same check the text lockfile applies)
- compile: bounds-check Mach-O segment offsets/sizes with
overflow-checked arithmetic before patching; a corrupted template now
errors instead of crashing
- webview: the default Chrome profile directory is created with an
unpredictable name and owner-only permissions

### node:http / node:http2 / debugger / V8 shim
- node:http: a `host` option containing URL-reserved delimiters is
treated as an unresolvable hostname instead of being re-parsed into a
different target
- node:http2: the raw-socket TLS upgrade path forwards the server's
`requestCert`/`rejectUnauthorized` configuration into the native TLS
config explicitly
- debug adapter: only allowlisted inspector event domains from the debug
target are dispatched; the diagnostics signal listener binds to loopback
- v8 shim: `String::Utf8Length`/`WriteUtf8` saturate at `INT_MAX`
instead of wrapping for very large strings

### Runtime / fs / S3 / path
- node:fs: the read path re-fetches the destination buffer after
argument coercion can run user code; buffer-backed path arguments are
pinned for the duration of async operations
- S3: a malformed multipart upload ID from the server surfaces as a
request error instead of aborting the process
- node:path: `path.format` sizes its scratch buffer for the implicitly
inserted extension separator, removing a reachable abort

### Not changed
The bin-link containment behavior for dotless symlinked targets and the
binary-lockfile trust policy are unchanged (both previously decided);
the file-backed Blob deserialization finding is already covered by the
open #31329.

### Tests
9 validated regression tests (each fails on the released build — two of
them by crashing it — and passes here), plus 2 regression-locked tests
for repo-TypeScript debugger changes. The Chrome profile-dir and
h2-upgrade changes ship without standalone tests (no non-flaky
observable in existing files; noted per commit).

`cargo check` and the cross-target checks pass on all 10 CI targets; the
touched suites pass locally with no new failures versus main.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>