feat: more security improvements (GraphQL controls, CORS warning, request timeouts)

[deer]

• GraphQlOptions added with disableIntrospection(), maxDepth(int), and maxComplexity(int). GraphQlHandler.graphql() gains a second overload accepting options; introspection is blocked at request time (400), depth/complexity limits are wired via ChainedInstrumentation at schema build time.
• CorsMiddleware.allowAll() annotated @Deprecated and emits a Logger.warn() at call time so misuse surfaces in IDE inspections and runtime logs.
• RequestTimeout option added to serve-foundation. TimeoutExecutor (package-private in serve-transport-http) wraps the virtual-thread executor and schedules Thread::interrupt after the configured duration, protecting against Slowloris and hung handlers. New HttpTransport constructor overload accepts RequestTimeout; the scheduler is shut down in stop().