Reject unpaired JSON surrogate escapes

[He-Pin]

Motivation

Jsonnet strings are defined in Unicode-codepoint terms, and sjsonnet already rejects unpaired surrogate escapes in Jsonnet source strings. std.parseJson and the strict .json import fast path could still let JSON strings containing lone UTF-16 surrogate halves through as Jsonnet strings or defer the failure until a later string operation.

The better long-term fix belongs in ujson, where surrogate-pair validation can happen while decoding \uXXXX escapes without a downstream pass. This PR stays draft as a downstream guard while the upstream issue is tracked.

Modification

• Add ValVisitor.rejectUnpairedSurrogates for decoded JSON string values and object keys.
• Enable the check for std.parseJson, returning a normal Invalid JSON: unpaired surrogate in string error.
• Apply the same guard in the strict .json import fast path and preloader so imported JSON cannot expose malformed strings.
• Preserve valid surrogate pairs and escaped literal text such as "\\uD800".
• Keep the import fast path allocation-conscious with a private nullable parseJsonImportOrNull contract; a reusable OptionVal abstraction is intentionally left for a separate PR.
• Add regression coverage for lone high/low surrogates, surrogate object keys, valid surrogate pairs, escaped literal text, and Jsonnet fallback comments.

Result

std.parseJson now aligns with cpp-jsonnet and jrsonnet by rejecting unpaired surrogate escapes, while still accepting valid surrogate pairs. go-jsonnet currently normalizes these cases to U+FFFD.

Case	sjsonnet before this PR	sjsonnet after this PR	cpp-jsonnet	go-jsonnet	jrsonnet
std.codepoint(std.parseJson("\"\\uD800\""))	55296	error	error	65533	error
std.codepoint(std.parseJson("\"\\uDC00\""))	56320	error	error	65533	error
std.codepoint(std.parseJson("\"\\uD83D\\uDE00\""))	128512	128512	128512	128512	128512
std.codepoint(std.objectFields(std.parseJson("{\"\\uD800\":1}"))[0])	55296	error	error	65533	error
strict .json import {"s":"\\uD800"} then std.codepoint((import "surrogate.json").s)	not rejected by JSON import; later std.codepoint errors on a malformed string	Invalid JSON: unpaired surrogate in string	n/a	n/a	n/a
strict .json import {"s":"\\uD83D\\uDE00"} then std.codepoint((import "pair.json").s)	128512	128512	n/a	n/a	n/a

Import rows are sjsonnet-specific because this PR changes sjsonnet's .json import fast path.

References

• Official Jsonnet std.parseJson documentation: https://jsonnet.org/ref/stdlib.html#std-parseJson
• go-jsonnet issue for surrogate behavior: std.lines() fails on any string input: 'Unexpected type string, expected array' google/go-jsonnet#885
• ujson upstream tracking issue: ujson accepts unpaired JSON surrogate escapes as raw UTF-16 surrogates com-lihaoyi/upickle#722
• RFC 8259 section 8.2 on surrogate interoperability hazards: https://www.rfc-editor.org/rfc/rfc8259#section-8.2