fix(security): harden Live Components against critical vulnerabilities

[MarcosBrendonDePaula]

Fixes multiple security vulnerabilities in the Live Components system:

CRITICAL:

• Block arbitrary method execution via executeAction (CWE-94): add blocklist
  of internal methods + support for publicActions whitelist on components
• Prevent cross-component rehydration (CWE-434): embed and validate
  __componentName in signed state to detect state tampering

HIGH:

• Add per-connection WebSocket rate limiting (CWE-770): token bucket algorithm
  prevents message flooding/DoS
• Restrict file uploads (CWE-434): MIME type allowlist, blocked extensions,
  50MB max size (was 500MB), UUID-based filenames, path traversal prevention
• Add room authorization checks (CWE-269): enforce liveAuthManager.authorizeRoom
  on ROOM_JOIN, prevent client from setting initial room state

MEDIUM:

• Use crypto.randomUUID() for component and connection IDs (CWE-287)
• Validate room names with regex (CWE-20): block path traversal and injection
• Add room state size limits of 10MB (CWE-770)
• Log auth failures instead of silently ignoring (CWE-391)
• Remove stack traces and available component names from error messages (CWE-209)

Includes 65 new security attack tests validating all fixes.

https://claude.ai/code/session_01BAtMnYwE3T7k6F569Y4JS4