Hardening: input validation and bounds tightening across 36 subsystems (round 4) (#31339)

Continues the hardening series (rounds 1–3) with another pass of input
validation, bounds checking, and lifetime tightening across the
codebase. 73 changes, each in its own commit, plus regression tests
covering 55 of them (each test verified to fail on the released bun and
pass on this branch).

Areas touched: install / lockfile / tarball extraction / bunx / upgrade,
sql (postgres, sqlite), tls / sockets / dns, http2 / http3 / http client
/ server, markdown, shell, node:fs / zlib / spawn / streams, crypto, vm,
yaml / semver / valkey / undici / url / cookies, dev server, transpiler
cache, string handling.

The general shape of the changes: reject malformed or out-of-range
inputs earlier, bound buffer and recursion growth, keep borrowed buffers
alive (or copy them) for the duration of the operations that read them,
and validate names/paths/headers before they are used to address files,
hosts, or memory.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>