Remote DoS through unchecked `IdList` allocation in negentropy

Summary

## Summary

The `negentropy` crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the `std` feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

## Details

When processing an `IdList` range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

```rust let mut their_elems: HashSet<Id> = HashSet::with_capacity(num_ids as usize); ```

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, `catch_unwind` cannot contain the failure.

Both `reconcile` and `reconcile_with_ids` reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

```rust if num_ids > (query.len() / ID_SIZE) as u64 { return Err(Error::ParseEndsPrematurely); } ```

## Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards `NEG-OPEN` or `NEG-MSG` reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default `std` feature enabled. Builds without `std` use a `BTreeSet` and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

## Credit

Discovered and fixed by **Alex Gleason** (<https://github.com/alexgleason>).