fix: reject NUL bytes and invalid UTF-8 in text parameters with a 400

[Mohil-Ahuja]

Fixes #1114

A NUL byte or invalid UTF-8 in a path or query parameter, or in the position of a hand-built cursor, now gets a 400 on every log store instead of a 500 from PostgreSQL (SQLSTATE 22021).

Change

• TextParamsMiddleware (internal/apirouter/textparams_middleware.go) runs after auth on every API route. A path or query value holding a NUL byte or invalid UTF-8 is answered with a 400 that names the parameter, in the same style as the limit errors: invalid tenant_id: must be valid UTF-8 without NUL bytes. It covers the list filters, the tenant_id query on the retrieve endpoints, the metrics filters and path IDs like /events/:event_id, so nothing like that reaches a store. Valid non-ASCII text is untouched.
• cursor.Decode treats a position with a NUL byte or invalid UTF-8 as invalid cursor. The cursor itself is base62, so it gets through the middleware; the check has to happen after decoding. This gives the same 400 on PostgreSQL (500 before) and ClickHouse (200 before).

I put the check in the router rather than in pglogstore so all log stores answer the same way, which is what the issue asks for. It also covers path parameters that go to the tenant store.

Tests

• TestAPI_InvalidTextParamReturns400: NUL and invalid UTF-8 in query values, in one value of an array parameter, in path parameters (including nested ones) and in a metrics filter.
• TestAPI_ValidTextParamIsAccepted: plain and non-ASCII values still list normally.
• TestAPI_InvalidCursorReturns400: two new cases, a position with a NUL byte and one with invalid UTF-8, on all four lists.
• TestDecode: the same at the cursor package level.

On the previous code the new API tests fail (200 or 404 on the mem store, where PostgreSQL gave the 500), and the tenant cursor cases give invalid cursor: invalid timestamp. With the change, go test -short ./internal/apirouter/ ./internal/cursor/ passes, along with go build ./..., go vet and gofmt. I didn't run the PostgreSQL integration suite locally; the change sits in front of the store, so the store code is unchanged.

[alexluong]

Thanks for your first contribution to Outpost, and welcome! This looks good to me, merging it in.