refactor(security): harden legacy C string functions and buffer bounds

[mcoliver]

Description

Audit and refactor unsafe legacy C string functions (sprintf, vsprintf, strcpy) and buffer boundaries across first-party core code in OpenUTV.

Summary of Hardening:

1. Unbounded Formatted Printing (sprintf / vsprintf):

   • Converted all active occurrences in src/lib/ and src/bin/ to snprintf / vsnprintf with explicit buffer bounds:
     • src/lib/image/MovieFFMpeg/MovieFFMpeg.cpp: rotation string formatting and audio metadata attributes.
     • src/lib/image/IOdpx/IOdpx.cpp: timecode calculation and header descriptor attributes.
     • src/lib/image/IOpng/IOpng.cpp, IOjpeg/IOjpeg.cpp, IOtiff/IOtiff.cpp, IOz/IOz.cpp, IOmray/IOmray.cpp, TwkImg/TwkImgSgiIff.cpp.
     • src/lib/app/RvApp/RvSession.cpp, RvGraph.cpp, src/lib/ip/IPCore/IPGraph.cpp, Session.cpp, SourceGroupIPNode.cpp: unique node naming logic (eliminated thread-unsafe static buffers and unconstrained sprintf).
     • src/lib/base/TwkUtil/Notifier.cpp: object address formatting.
     • src/lib/files/Gto/Parser.y, Writer.cpp: reader/writer formatted error/warning reporting with vsnprintf and missing va_end cleanup.
     • src/lib/mu/Mu/ & MuLang/: compiler & assembler error reporting (NodeAssembler.cpp, Grammar.y), parameter naming (FunctionSpecializer.cpp, TupleType.cpp, PartialApplicator.cpp, FixedArrayType.cpp, DynamicArrayType.cpp, MuLangContext.cpp), and primitive string serialization (StringType.cpp).

2. Unchecked String Copying (strcpy):

   • PanavisionLUT.cpp: Removed stack buffer and strcpy entirely when parsing entries header.
   • RvApplication.cpp:
     • Replaced dynamic char[] buffer and strcpy in baked URL decoding with safe std::string accumulation.
     • Protected hex URL encoding by casting to unsigned char (preventing negative-char expansion buffer overflow) and using snprintf.
     • Replaced vector<char> with QString::asprintf for the About dialog.
   • StringType.cpp: Replaced strcpy with memcpy in StringType::String::set and setn bounded by size (preventing out-of-bounds reads and overflows on non-null-terminated buffers).
   • MovieSideCar/Common.cpp: Replaced strcpy with strncpy bounded by Message::SizeInBytes().
   • TwkImgCineonIff.cpp: Replaced strcpy with strncpy bounded by header field sizes.
   • main.cpp across CLI executables (rv, utv, rvpkg, rvio): Replaced in-place strcpy(argv[i], "-help") with direct pointer reassignment.
   • Lexer.l & Grammar.y: Bounded operator token copying into _op[4] with strncpy.

Closes #51