fix: bound scrape query parameter parsing (#2285)

[arnabnandy7]

Summary

Fixes #2285.

• Add bounds to default scrape query parsing:
  • max query string length: 64 KiB
  • max query parameter count: 1024
• Avoid unbounded queryString.split("&") allocation by scanning the query string incrementally.
• Return HTTP 400 for invalid/excessive query parameters instead of surfacing an internal error.
• Deduplicate metric name filter collections with LinkedHashSet.
• Add exact-match fast paths in MetricNameFilter while preserving existing suffix-tolerant matching behavior.
• Add regression tests for excessive query length and parameter count.

Testing

• mise run lint:fix
• ./mvnw.cmd test -pl prometheus-metrics-exporter-common -Dtest=PrometheusScrapeHandlerTest '-Dcoverage.skip=true' '-Dcheckstyle.skip=true'
• ./mvnw.cmd test -pl prometheus-metrics-model -Dtest=MetricNameFilterTest '-Dcoverage.skip=true' '-Dcheckstyle.skip=true'
• ./mvnw.cmd install -DskipTests '-Dcoverage.skip=true' -rf :prometheus-metrics-model

Note: mise run build fails on Windows because the task invokes ./mvnw; the equivalent mvnw.cmd command was run instead.