[codex] Harden repo security audit findings

[Elodie Mirza (elodiejmirza)]

BLUF

• Fixes the repo-wide security audit findings found during the v3.0.0-rc.1 fix-forward pass.
• Adds a concise tracked audit summary for release evidence.
• Leaves the detailed local scan artifacts out of the repo to avoid committing temporary audit output.

Changes

• Escape user-controlled CLI diagnostic values for unknown options, invalid --fail-on, and path open/read errors.
• Reject all ASCII control bytes in APRS-IS login/profile fields.
• Add finite default TCP connect/read timeouts while preserving explicit caller override.
• Update APRS-IS examples/docs to prefer profile_line() for untrusted login fields.
• Add docs/security-audit-v3.0.0-rc.1.md and link it from release notes/security docs.

Security Review Result

• Closed: CLI diagnostic control-character injection.
• Closed: APRS-IS login/profile ASCII-control injection.
• Closed: TCP default indefinite-blocking denial of service.
• Open findings: none after fix-forward audit.

Verification

• cargo fmt --check
• cargo test -p aprs-cli -p aprs-transport-aprs-is
• cargo test -p aprs-transport-tcp -p libaprs-engine
• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• scripts/verify-docs.sh

Next Gate

• Wait for CI, security, merge-gate, and supply-chain checks.
• Fix forward on this branch if any check fails.
• Merge only when checks and secure-review findings are clean.