Fix LSP message bounds and position reads

[Widthdom]

Summary

• Bound LSP frame and header-line parsing before payload buffer allocation.
• Restrict LSP position-based requests to indexed project files, reject outside/unindexed/oversized documents, and preserve workspace path casing semantics.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~LspServerTests" -p:UseSharedCompilation=false
• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog/CodeIndex.Changelog.csproj -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• git diff --check origin/main..HEAD
• Codex adversarial review: No blocking/actionable issues found.

Attempted dotnet test CodeIndex.sln -p:UseSharedCompilation=false; it was manually stopped after roughly 30 minutes without a final summary. Focused LSP tests and solution build passed.

Changelog

• changelog.d/unreleased/2825.fixed.md
• changelog.d/unreleased/2826.fixed.md

Follow-ups

None.

Fixes #2825
Fixes #2826