Fix 4 Security Vulnerabilities: Quota Bypass, Zip Bomb DOS, XXE, Command Injection

[jmadhur87]

This MR fixes 4 security vulnerabilities in fcli affecting the Aviator audit command and MCP tool argument handling.

Changes

1. Quota Bypass Fix (AviatorSSCAuditCommand.java)

• Changed from fail-open to fail-closed behavior
• When quota cannot be determined AND user requested protection, audit is skipped instead of proceeding
• Prevents bypassing quota limits via endpoint degradation

2. Zip Bomb Protection (Constants.java, FileUtils.java)

• Added 50MB file size limit for source files
• Size validation occurs before decompression
• Prevents DOS attacks from malicious FPR archives

3.XXE Protection (DastFprCorrelationEnricher.java)

• Disabled DOCTYPE declarations and external entity processing
• Prevents XML external entity injection attacks

4.Command Injection Fix (MCPToolArgHandlerActionOption.java)

• Quote escaping in option values (" → ")
• Prevents LLM/attacker from injecting arbitrary fcli CLI arguments via quote breakout