fix(tests+security): custom script timeout tests, client-id metric, test fixes, ArangoDB hardening

[lakhansamani]

Summary

New Tests

• Custom access token script timeout tests (7 test cases): Verifies the 5-second execution timeout from fix(security): add 5-second execution timeout for custom access token scripts #571 works correctly — custom claims, reserved claim protection, infinite loop timeout, script errors, ID token claims
• Client-ID mismatch metric test (3 test cases): Verifies the new security metric fires on mismatch but not for dashboard/admin/app paths

Security Improvements

• Client-ID mismatch metric: Records authorizer_security_events_total{event="client_id_mismatch"} when an invalid client ID is provided, excluding /dashboard and /app paths to avoid noise from internal UI requests
• ArangoDB bind variables: Converted all LIMIT %d, %d patterns to LIMIT @offset, @limit with bind variables for defense-in-depth consistency across 5 ArangoDB provider files

Test Suite Fixes (all 86 test cases now pass)

• TestJWKSEndpointCompliance: Updated to test both HMAC (expects empty keys per fix(security): prevent HMAC key leak in JWKS and fix redirect URI wildcard #570) and RSA (expects valid keys) configurations
• TestEndpointTest: SSRF validation now skips in test environment to allow localhost test servers
• TestAddWebhookTest: Use UserDeactivatedWebhookEvent to avoid data isolation issues with other webhook tests
• TestResendOTP, TestVerifyOTP, TestResetPassword, TestUpdateProfile: Replace hardcoded phone numbers with unique time-based values to prevent cross-test collisions

Files Changed

• internal/integration_tests/custom_access_token_script_test.go — new test file (7+3 test cases)
• internal/http_handlers/client_check.go — add security metric on mismatch
• internal/graphql/test_endpoint.go — skip SSRF in test env
• internal/storage/db/arangodb/{user,email_template,verification_requests,webhook_log,audit_log}.go — bind variables
• internal/integration_tests/{add_webhook,oauth_standards_compliance,resend_otp,reset_password,update_profile,verify_otp}_test.go — test fixes

Test plan

• make test-sqlite passes (86/86 test cases, 0 failures)
• make test-arangodb to verify bind variable changes