docs: update documentation, type declarations, and exports for security release

- README: changelog with all 43 fixes, breaking changes table, migration guide
- Middleware README: requiredTokenType, API_KEY_SYMBOL, standardHeaders modes,
  RAW_BODY_SYMBOL, empty body handling documentation
- Type declarations: fix limit as number|string, add deferNext, parseNestedObjects,
  allowedHeaders function variant, RateLimitOptions.message, BodyParserOptions
  extended fields, parseLimit export, extractTokenFromHeader/maskApiKey alignment
- Exports: re-export extractTokenFromHeader, maskApiKey, parseLimit from index.js
- Add SECURITY_REVIEWS.md tracking all 43 resolved vulnerabilities

Author: jkyberneees