Cap TypeScript path alias parsing work

[Widthdom]

Summary

• Cap TypeScript/jsconfig compilerOptions.paths alias rule counts, per-rule and total target counts, and alias/target string lengths.
• Cap oversized module specifiers and wildcard-substituted target lengths before path probing, with bounded warnings for skipped work.
• Add focused SymbolExtractor coverage for truncation, ignored long strings, oversized module specifiers, and oversized wildcard substitution.

Documentation / Changelog

• Added changelog fragment: changelog.d/unreleased/3069.security.md.
• No README/DEVELOPER/TESTING guide changes were needed because this is a bounded internal hardening of existing TypeScript/jsconfig alias resolution behavior.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~SymbolExtractorTests.Extract_TypeScript_"
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~SymbolExtractorTests.Extract_TypeScript_"
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Final Codex adversarial review: No blocking/actionable issues found.

Known validation notes:

• Full dotnet test was attempted earlier and hit the existing DiagnosticSanitizer timeout/hang tracked by DiagnosticSanitizer can time out while sanitizing plugin registry diagnostics #3292; the isolated reported test passed afterward.
• Refreshed this PR onto latest main (f7c94f1) after the McpAuditLog request-id truncation regression test writes no audit event #3304/Fix #3267: Secure Suggestion store JSON with private permissions #3352 fixes landed. The PR is now 1 commit ahead and 0 behind main at head c143f288.
• New CI runs for head c143f288 are queued: Build and Test run 27017028579, CodeQL run 27017028504, and Changelog Fragments run 27017028751.
• Post-refresh local validation could not be rerun because local shell execution failed in the current sandbox; the TypeScript path alias parsing should cap paths rule count, target count, and string lengths #3069 diff remains scoped to the same 3 files and the previous focused validation/adversarial review apply to that patch.

Fixes #3069