Fix high-severity security vulnerabilities

[ConsoleTVs]

Summary

Addresses 9 high-severity security vulnerabilities identified during the comprehensive security audit (findings #4-#12 from the audit report). This PR builds on top of the critical fixes in #3.

Information Leakage Prevention (problem)

• Defaulted() no longer auto-populates Detail from err.Error(), preventing raw database errors, file paths, and SQL fragments from reaching clients
• Instance field now uses request.URL.Path instead of request.URL.String() to avoid leaking query parameters that may contain tokens

Error Handler Hook Bypass (framework)

• handleError now receives the wrapped ResponseWriter instead of the original, ensuring BeforeWriteHeader hooks fire consistently for both success and error paths
• Fixes broken logger middleware status tracking for error responses
• writeHeaderCalled changed from plain bool to sync/atomic.Bool to prevent data races

Server Timeout Configuration (framework)

• Added NewServer and NewServerWith helpers that create http.Server with secure timeout defaults (ReadHeaderTimeout: 10s, ReadTimeout: 30s, WriteTimeout: 60s, IdleTimeout: 120s)
• Prevents Slowloris and connection-exhaustion attacks that are possible with http.ListenAndServe (zero timeouts)

Security Headers Middleware (framework/middleware)

• New SecureHeaders() middleware sets X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, X-XSS-Protection, and Strict-Transport-Security
• Fully configurable via SecureHeadersWith() for application-specific needs

Rate Limiting Middleware (framework/middleware)

• New RateLimit() middleware using per-key token bucket algorithm (golang.org/x/time/rate)
• Defaults: 10 req/s per IP, burst of 20
• Configurable key extraction, rates, and error response via RateLimitWith()

Open Redirect Prevention (contract/response)

• Added SafeRedirect() that validates URLs are relative paths before redirecting
• Returns ErrUnsafeRedirect for absolute URLs, protocol-relative URLs, javascript:, and data: URIs
• Original Redirect() preserved with warning documentation

Panic Safety Improvements (contract/request)

• Added TryHooks() as a non-panicking alternative to Hooks()
• Added WARNING documentation to MustSession, MustSessionKeyed, and Hooks directing users to safe alternatives

Goroutine Exhaustion Prevention (framework/event)

• MemoryBroker now bounds concurrent deliveries with a semaphore (default 1024)
• Close() waits for in-flight deliveries via sync.WaitGroup instead of potentially leaking goroutines

Breaking Changes

Defaulted() no longer auto-populates Detail

What changed: problem.Defaulted() no longer sets Detail from the wrapped error's .Error() message.

Migration:

// Before: Detail was auto-populated from err.Error()
problem.NewProblem(err, 500).ServeHTTP(w, r)

// After: Set Detail explicitly if you want it in the response
problem.Problem{
    Detail: "A user-friendly message",
    Status: 500,
}.WithError(err).ServeHTTP(w, r)

Why: Internal error messages (database errors, file paths, SQL) were being exposed to HTTP clients.

New Dependencies

• golang.org/x/time v0.15.0 (for rate limiting)