Bound synthesized rows in v1 OpenXml queries

[shps951023]

Summary

Backports the OpenXml query hardening from #1016 to v1.x-maintenance.

• validate worksheet row and cell references against Excel's XFD1048576 limits before filling missing rows
• reject invalid integer coordinates passed to QueryRange
• add a configurable MaxSynthesizedCells budget, defaulting to 100,000, to prevent sparse worksheets from amplifying into excessive allocations
• cover crafted row indices, oversized dimensions, maximum valid coordinates, and synchronous/asynchronous query paths

Security impact

This prevents a crafted worksheet row index or sparse worksheet dimension from causing MiniExcel to synthesize an excessive number of empty row objects and cells during Query enumeration.

Testing

dotnet test tests/MiniExcelTests/MiniExcelTests.csproj

375 tests passed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9c4fa3ba-3603-45e5-b668-a7c8a7078337

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[shps951023]

@michelebastione good day, this's critical issue, could you please to review?