fix: bound scrape query parameters

[zeitlinger]

Summary

• bound default query parsing by query length and parameter count
• return HTTP 400 for malformed or excessive query parameters
• deduplicate exact metric-name filters before lookup

This is the focused replacement for the #2285 portion of #2297.

Fixes #2285

Ongoing discussion

None currently. The malformed percent-encoding case raised during the earlier review is covered and returns HTTP 400.

Validation

• mise run lint:fix
• mise run build
• ./mvnw test -pl prometheus-metrics-exporter-common,prometheus-metrics-model -Dcoverage.skip=true -Dcheckstyle.skip=true

[github-actions]

⚠️ API changes detected — maintainer review required

This PR modifies the published API diff for the following module(s):

• prometheus-metrics-exporter-common

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.