Security Hardening & Documentation Refresh

[peter-lawrey]

A security-focused hardening sweep for Chronicle Wire and adds the contributor guidance needed to keep it that way.

📚 Docs & Process

File	Change
AGENTS.md	Adds Security checklist section – every PR must: 1) run a security diff review, 2) forbid committing secrets, 3) document deliberate trade-offs.
src/main/adoc/security-review.adoc index.adoc	New AsciiDoc detailing known trade-offs (unsafe, field-less binary, TL caches, etc.) and links it from the doc index.

---

🛠️ Runtime Safeguards

Area	What’s new	Risk mitigated
Path traversal / SSRF	MarshallableOutBuilder & FileMarshallableOut now reject file:// paths containing ..; HTTPMarshallableOut validates that the host is not local/site-local unless allowLocalhost() is explicitly enabled.	Accidental or malicious file overwrite, internal network probes
Self-describing trivially-copyable objects	Hard limit of 256 primitive fields per description; exceeding triggers IllegalStateException.	CPU / OOM bombs, malformed-description memory corruption
ConfigLoader	Rejects property-expansion values containing LF/CR to prevent YAML structure injection.	Arbitrary YAML injection, config confusion
Builder opt-in	MarshallableOutBuilder.allowLocalhost() flag to override SSRF check for trusted test rigs.	Safer defaults
URL sanity check helper	Centralised validation for file and HTTP builders.	Consistency

---

🧪 Tests

• FileMarshallableOutValidationTest – path traversal rejection
• MarshallableOutBuilderTest – SSRF guard + localhost opt-in
• EmbeddedBytesMarshallableTest – field-count ceiling
• ConfigLoaderInjectionTest – newline-injection rejection