fix: cap github caches and sanitize og user injection (JhaSourav07#1997)

## Description

Fixes JhaSourav07#1987

This PR resolves two high-severity issues:
1. **DoS via Uncapped Cache (OOM Mitigation)**: Applies a strict
`maxSize` cap of 1000 items to the `TTLCache` instances
(`contributionsCache`, `profileCache`, `reposCache`) in `lib/github.ts`.
This ensures Vercel serverless function memory usage remains bounded
regardless of request volume, preventing Out-Of-Memory (OOM) crashes.
2. **SSRF / Open Graph Injection Mitigation**: Hardens the
`/api/og/route.tsx` endpoint by strictly sanitizing the `user` input
parameter. It now strips all non-alphanumeric/hyphen characters and caps
the string length to 39 characters (GitHub's maximum username length)
before executing the fetch or injecting it into the unescaped JSX
`ImageResponse`.

## Pillar

- [ ] dYZ" Pillar 1 ?" New Theme Design
- [ ] dY"? Pillar 2 ?" Geometric SVG Improvement
- [ ] dY ? Pillar 3 ?" Timezone Logic Optimization
- [x] dY>,? Other (Bug fix, refactoring, docs)

## Visual Preview
N/A (Backend Security Fixes)

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
- [x] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have started the repo.
- [x] I have made sure that i have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
- [x] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: JhaSourav07

app/api/og/route.tsx

@@ -37,10 +37,12 @@ function getLuminance(hex: string) {
 
 export async function GET(req: NextRequest) {
   const { searchParams } = new URL(req.url);
+  const parsed = ogParamsSchema.parse(Object.fromEntries(searchParams.entries()));
+  let { user } = parsed;
+  const { theme, bg, text, accent } = parsed;
 
-  const { user, theme, bg, text, accent } = ogParamsSchema.parse(
-    Object.fromEntries(searchParams.entries())
-  );
+  // Sanitize user: limit to 39 chars (GitHub max length) and strip invalid chars
+  user = user.slice(0, 39).replace(/[^a-zA-Z0-9-]/g, '');
 
   const selectedTheme = themes[theme] || themes.dark;
   const resolvedBg = `#${bg || selectedTheme.bg}`;