fix: harden metric scrape edge cases

[zeitlinger]

Summary

This addresses the bug reports from #2282, #2283, #2284, #2285, #2286, and #2287 in one PR.

• Fix Buffer stripe indexing so large thread IDs cannot produce negative stripe indexes.
• Bound the Buffer spin wait during collection and replay buffered observations before failing the scrape on timeout.
• Return a generic HTTPServer error response instead of exposing stack traces to clients.
• Avoid blocking the HTTPServer dispatcher on executor saturation by using a bounded queue with the default rejection policy.
• Close rejected authenticated request bodies instead of draining them without a size limit.
• Bound default query parsing by query length and parameter count, and return HTTP 400 for invalid query parameters.
• De-duplicate exact metric-name filters for faster lookup.
• Redact invalid configuration values from PrometheusPropertiesException messages.

Fixes #2282
Fixes #2283
Fixes #2284
Fixes #2285
Fixes #2286
Fixes #2287

Validation

• mise run lint:fix
• ./mvnw -pl prometheus-metrics-core,prometheus-metrics-config,prometheus-metrics-exporter-common,prometheus-metrics-exporter-httpserver,prometheus-metrics-model test -Dcoverage.skip=true -Dcheckstyle.skip=true
• mise run build

[github-actions]

⚠️ API changes detected — maintainer review required

This PR modifies the published API diff for the following module(s):

• prometheus-metrics-exporter-httpserver

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.