fix: bound Censys responses and API outcomes

[sodle-splunk]

Summary

• stream Censys responses through a fixed byte budget before JSON decoding
• reject search pages that exceed the requested row count and enforce an action-level deadline across pagination
• validate numeric, textual, malformed, and noncanonical API outcome fields fail closed
• recognize certificate misses only from an explicit HTTP 404 instead of response text

Validation context

This is a follow-up to merged PR #26 for PAPP-38109 under ESPM-5228. It addresses the remaining source-validation paths for VULN-94540 and VULN-94544.

Quality gate

• full pre-commit run --all-files passed
• focused regressions passed: 9 passed
• compile workflow pending
• dual-review PSIRT source validation pending on immutable head d4795e7 (full provider SHA to be recorded by reviewers)

Resource bounds and API outcome handling are separate functional commits with matching release-note lines. Do not squash this PR; semantic-release relies on commit history.

Authored by Codex.

[github-actions]

Merging this PR will release 2.2.6 with the following release notes:

2.2.6 (2026-08-01)

Connector release changes

• Bound Censys response bodies before JSON decoding and reject oversized search pages.
• Apply a cumulative deadline with bounded connect and read timeouts across all pages in a Censys search action.
• Enforce the same wall-clock deadline while Censys response status and headers are received.
• Validate Censys body status fields fail closed and recognize certificate misses only from HTTP 404.

[phantom-jacob]

Written by Codex for Jacob: Reviewed and approved at exact head 4fe7462.

[splunk-soar-semantic-release]

🎉 This PR is included in version 2.2.6 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀