fix(cypher): bound OPTIONAL fallback in expand_pattern_rels to prevent heap overflow (#627)

[SEPURI-SAI-KRISHNA]

What does this PR do?

Fixes a heap buffer overflow (CWE-787) in expand_pattern_rels
(src/cypher/cypher.c) when expanding an OPTIONAL MATCH relationship pattern.
Another root cause behind the still-open #627 ("Crash when calling
query_graph"). The query text is agent-controlled via the MCP query tool.

The per-hop output buffer is sized bind_cap * 10 + 1:

size_t alloc_n = (size_t)*bind_cap * (size_t)CYP_GROWTH_10 + SKIP_ONE;

The expansion helpers (expand_fixed_length / expand_var_length) correctly
stop at max_new = bind_cap * 10. But the OPTIONAL fallback that keeps a row
with the target left unbound is not bounded:

if (is_optional && match_count == 0) {
    ...
    new_bindings[new_count++] = nb;   // no bound check
}

The + 1 leaves room for a single OPTIONAL row after a saturated
expansion. When one source binding saturates the expansion to max_new and
two or more later sources take the OPTIONAL (no-match) path, the second
fallback write runs past the allocation.

Reachable with e.g.:

MATCH (a:Function) OPTIONAL MATCH (a)-[:CALLS]->(b) RETURN a.name

whenever bind_cap tracks the scanned node count — i.e. the number of matched
start nodes exceeds the result limit. That happens on a large repo (more
functions than the 100000 result ceiling — e.g. the Linux kernel, a flagship
target) even at the default limit, and on any repo when an agent supplies a
smaller max_rows. A dense hub (out-degree ≥ bind_cap * 10, e.g. a generated
dispatch table or god object) saturates the buffer; the leaf functions that
follow then overflow it.

The fix sizes the buffer for the worst case — up to max_new expanded rows
plus one OPTIONAL fallback row per source binding — and bounds the fallback
write, matching the max_new checks the expansion helpers already do.

Reproduced first (ASan, before the fix):

==ERROR: AddressSanitizer: heap-buffer-overflow ... WRITE of size 1624
    #0 expand_pattern_rels src/cypher/cypher.c:3257   (OPTIONAL fallback write)
       allocated at src/cypher/cypher.c:3225          (bind_cap*10 + 1 malloc)
    #5 test_cypher_exec_optional_rel_saturated_no_overflow
SUMMARY: AddressSanitizer: heap-buffer-overflow ... in expand_pattern_rels

After the fix the full cypher suite passes with no sanitizer errors.

Adds regression test cypher_exec_optional_rel_saturated_no_overflow (a hub
that saturates the expansion followed by leaf functions on the OPTIONAL path).

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)