fix: close review issues #6-#13

[enochgroot]

Closes #6 #7 #8 #9 #10 #11 #12 #13

One PR for the eight OPEN review findings on the 2.0 modernization tree.

Changes

• Pin production nan to an exact version #6 Pin production nan to exact 2.28.0; lockfile matches; CI uses npm ci.
• Drop EOL Node 18 and 20 from engines and CI #7 engines.node is >=22; CI matrix is Node 22/24 only (no 18/20).
• Cap Stream receive buffer so incomplete frames cannot grow until OOM #8 msgpack.Stream rejects a receive concat that would exceed MAX_STREAM_BYTES before allocate; drops buf on close/end/error.
• Pin GitHub Actions uses: to commit SHAs #9 GitHub Actions uses: pinned to full SHAs (checkout@v4.2.2, setup-node@v4.4.0, setup-python@v5.6.0).
• Cap pack() array Length walk (same 1e6 policy as unpack) #10 pack() snapshots Length() then applies kMaxContainer on array and map walks.
• Cap CLI stdin concat in msgpack2json / json2msgpack #11 json2msgpack / msgpack2json refuse stdin larger than MAX_STDIN_BYTES before concat.
• Document a risk-based bump window for vendored msgpack-c and NAN #12 SECURITY.md documents a risk-based bump window.
• Pin devDependency c8 to an exact version #13 Pin c8 to exact 12.0.0.

Tests

npm test: 135 pass.
JS coverage gate 95% (c8 --check-coverage).
Native coverage: 96.0% lines, 99.5% branches, 100% functions (gcovr --fail-under-line 95 --fail-under-branch 95).

Sabotage: Stream cap tests fail without the allocate check; pack sparse-array test fails without kMaxContainer; CLI tests fail without the stdin cap.

Coverage gate in package.json / COVERAGE.md is unchanged.

[enochgroot]

Addressed review OPEN Low (9): Stream now re-emits underlying socket errors after dropBuf, gated on !dead so rejectLimit + destroy(err) still emits once. Tests cover socket-error forwarding and the rejectLimit once-only path. 80e77d0.

[enochgroot]

Superseded by a rebase onto live upstream 3.4.0 (c0f78a1). See msgpack#25695.