[codex] Bound TypeScript alias config parsing

[Widthdom]

Summary

• Add bounded JsonDocumentOptions for TypeScript/JavaScript path alias config parsing.
• Report malformed or too-deep tsconfig.json / jsconfig.json parsing through the existing TypeScript path-alias warning path.
• Add regression coverage for malformed JSON and JSON depth limits.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~Extract_TypeScript_MalformedTsconfigSkipsPathAliasesWithWarning|FullyQualifiedName~Extract_TypeScript_DeepTsconfigJsonSkipsPathAliasesWithWarning|FullyQualifiedName~Extract_TypeScript_OversizedTsconfigSkipsPathAliasesWithWarning"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~SymbolExtractorTests"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Adversarial review: No blocking/actionable issues found. A separate codex exec review attempt was blocked by the local usage limit, so the review was completed in the current Codex session using .codex/workflows/adversarial-review.md.

Documentation and Changelog

• Added changelog.d/unreleased/3033.security.md.
• No standalone docs were updated because this only tightens the existing TypeScript path-alias warning behavior and does not add a new command, flag, or documented workflow.

Follow-up Candidates

None.

Fixes #3033