* Apply bytesize and number of param limits in QueryParser

The param limit is 4096, chosen because it matches the existing
multipart limit.  The bytesize limit is 4MB.  These limits should
substantially exceed what almost all applications need, though
there will likely be applications that require higher limits.
Allow overriding the limits on a per-QueryParser basis via the
constructors, and allow overriding the default limits with
environment variables RACK_QUERY_PARSER_BYTESIZE_LIMIT and
RACK_QUERY_PARSER_PARAMS_LIMIT.

Add new Rack::QueryParser::QueryLimitError to raise in case one
of the limits are exceeded, and make ParamsTooDeepError an
alias to, since that is also a case where a limit is exceeded.
This allows code that already rescues ParamsTooDeepError to
automatically handle these other limits as well.

* Update CHANGELOG.

---------

Co-authored-by: Samuel Williams <[email protected]>

In Ruby 3.5, `cgi` will only contain functions related to escaping/unescaping.

https://bugs.ruby-lang.org/issues/21258

This is not an exact replicate of course, (`CGI::Cookie`) has some validations and coerces on setters but considering
for that purpose this is, they don't seem necessary?
During construction of the object rack already does conversions as necessary and setters don't make much sense, and aren't documented/tested for.

Although, for improved backwards compatibility, it wouldn't be much effort to make them `attr_accesor` instead.

[CVE-2025-49007]

There is a ReDoS in multipart parsing here because it is not anchored to
the start of a line and so may match as part of its comments.

Previously in f92e056 Content-ID and
Content-Type were changed to only accept tab and space as whitespace
characters. Although that's what the various RFCs show as their BNF,
I that's supposed to be interpreted _after_ lines have been unfolded and
so we need to allow FWS "Foldable White Space".

CR is not allowed unescaped as part of quoted-string. It might be
technically valid with a leading backslash, but I don't believe that
case is worth supporting.

Co-authored-by: Matthew Draper <[email protected]>