fix(security): bound git-history parsing to prevent DoS

[alxxjohn]

Motivation

• The history scanner previously streamed git log -p into bufio.Reader.ReadString('\n') and used context.Background() for the CLI, which allows unbounded per-line allocations and unbounded runtime when processing attacker-controlled repository history.

Description

• Cap total parsed git log stdout to 256 MiB using an io.LimitedReader and cancel the Git subprocess when the limit is exceeded to avoid unbounded output processing.
• Replace unbounded ReadString calls with a new readBoundedLine helper that retains at most 64 KiB per diff line while draining the remainder so oversized single lines cannot cause large allocations or skip subsequent lines.
• Add a 5‑minute deadline to the scan-history CLI by using context.WithTimeout to prevent unbounded scan execution.
• Add a regression unit test TestReadBoundedLineDrainsOversizedLine that verifies oversized lines are truncated in-memory while subsequent lines remain readable.

Testing

• go test ./internal/codeguard/history ./internal/cli ./pkg/codeguard ran and passed.
• go test ./... ran and passed.
• git diff --cached --check ran and passed.
• The repository commit was created with the change message fix(security): bound git history secret scans and staged files verified via git status --short --branch (all checks succeeded).

---

Codex Task