fix: bound aggregate header sections

[mcollina]

Add secure aggregate limits for initial headers and trailers.

Each section now has independent configurable byte and field-count budgets:

• max_header_bytes / max_header_count
• max_trailer_bytes / max_trailer_count

Defaults are 65,536 bytes and 100 fields per section; zero disables an individual limit. Byte totals include each field's terminating CRLF and exclude the final empty CRLF. Checked arithmetic fails closed on overflow. Limits are checked on complete field lines before syntax/semantic processing and totals commit only after validation and event delivery.

The configuration and read-only counters are wired through Rust's Parser, the native C ABI/setters, WASM layout offsets/getters/setters, generated packages, and Rust/C++/JS reference docs. Rust and mirrored WASM tests cover defaults, exact boundaries, unlimited mode, headers, trailers, managed fragmentation, and event-buffer retry accounting. Existing stress tests explicitly disable the new secure defaults where they intentionally generate thousands of fields.

Validation: full Rust parser suite and rebuilt 102-test WASM suite pass for SIMD; generated no-SIMD artifacts were also rebuilt. Independent review found no SEC-16 blockers.

Merge-order note: this should land after #54, which independently fixes SEC-07 atomic semantic-header event delivery. Keeping that prerequisite separate avoids combining findings in this PR.

This fixes SEC-16 from #38.