fix(security): [OBE-10709,OBE-10712,OBE-10718,OBE-11232,OBE-11234,OBE-11235,OBE-11236,OBE-11238,OBE-11555,OBE-11556] OOM/unbounded allocation bounds

[JuanMantica45]

What

Ten security fixes across six sources to eliminate OOM/unbounded allocation attack surfaces:

• GCS (OBE-10709): cap decompressed object size via .take(max_decompressed_bytes) (256 MiB default); set newline-framer max_length to 1 MiB (was None/unbounded)
• Logstash (OBE-10712): cap zlib decompression at 256 MiB; reject nested C frames (recursion bomb)
• WEF (OBE-10718, OBE-11236): enforce max_content_length on HTTP body via http_body_util::Limited; cap SLDC decompressor output at max_content_length × 100
• Newline framer (OBE-11232): NewlineDelimitedDecoder::new() now defaults to 100 KiB max-line length (was usize::MAX); applied to socket/TCP and statsd sources
• GELF (OBE-11235 parts 1 & 2): default pending_messages_limit to 1 000 and max_length to 5 MiB; replace O(N) per-message `tokio::spawn(sleep)` timeout tasks with a single `DelayQueue`-based reaper (O(1) tasks regardless of in-flight message count)
• STCP (OBE-11238): max_frame_bytes = 1 MiB buffer cap in decode(); BufferOverflow.can_continue() = false to terminate the stream; non-InSufficientData errors now propagate instead of being swallowed as Ok(None)
• STCP (OBE-11234): read_leb128_i64 returns Err(InSufficientData) on buffer exhaustion instead of Ok(0) (silent truncation that bypassed loop-count guards); field/header count caps in parse_event and read_legacy_event
• STCP (OBE-11556): max_lines_per_event = 10 000 cap in parse_lines — eliminates O(N×M) clone amplification from large field maps × many newlines in RAW
• TCP (OBE-11555): RequestLimiterPermit is now released before stream.write_all(&ack_bytes) — a zero-window peer can no longer park the permit indefinitely; 30-second write timeout added as defense-in-depth

Private submodule (lib/observo/private) is updated to the security-oom-bounds tip for WEF, STCP, and GCS changes.

Why

Multiple sources accepted arbitrary-size inputs from remote senders without any upper bound on allocation:

• A zip bomb to the GCS/Logstash/WEF decompressors would exhaust heap
• Sending a GELF stream that never closes message IDs would spawn an unbounded number of timeout tasks
• A STCP stream with many fields and many newlines in RAW would trigger O(N×M) clone amplification
• A slow peer holding a TCP connection open during ack write starved the RequestLimiter semaphore

How to Test

1. cargo test -p codecs --lib decoding::framing::chunked_gelf — 36 tests including new reaper eviction and limit tests
2. cargo test -p codecs --lib decoding::framing::newline_delimited — 7 tests including the 100 KiB default test
3. cargo test -p vector --lib sources::logstash (CI/Linux only — requires librdkafka) — includes decompression bomb and nested-C rejection tests
4. Private submodule tests require Linux (GSSAPI link issue on Mac); CI covers STCP and WEF tests
5. See docs/adr/security-oom-allocation-bounds.md for design rationale on non-obvious choices (LEB128 EOF semantics, SLDC expansion ratio, Arc-sharing deferral)

Jira: OBE-10709, OBE-10712, OBE-10718, OBE-11232, OBE-11234, OBE-11235, OBE-11236, OBE-11238, OBE-11555, OBE-11556