Bound and sanitize GitHub suggestion submission

[Widthdom]

Summary

• Bound outbound GitHub suggestion code scrubbing with a capped linear scanner for fenced and inline code.
• Read only a small GitHub API error body excerpt for failed issue creation and rate-limit diagnostics.
• Redact sensitive JSON-like error fields before stderr output and persisted retry details.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter FullyQualifiedName~GitHubIssueReporterTests -p:UseSharedCompilation=false
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Documentation / Changelog

• Added changelog.d/unreleased/2855.security.md.
• Added changelog.d/unreleased/2888.security.md.
• No AGENTS.md, CLAUDE.md, or AGENT_GUIDE.md changes.

Review

• Codex adversarial review: No blocking/actionable issues found.

Follow-up candidates

None.

Fixes #2855
Fixes #2888