fix(security): UrnController::bulk — cap input list at 1000

Each URN triggers parse → register find → schema find → object find
(~4 DB round-trips per item). Without a cap a caller can post 100k
URNs and force ~400k DB round-trips per request. Today the route is
effectively admin-only via the absence of @NoAdminRequired, so impact
is limited; a future relaxation would convert the missing cap into a
direct DoS lever. Reject with 422 above 1000.

Refs: #1419 review (concern 3) — discussion_r3187494464

Author: rubenvdlinde

lib/Controller/UrnController.php

@@ -149,6 +149,19 @@ public function bulk(?array $urns=null): JSONResponse
             return new JSONResponse(['error' => 'urns array is required'], Http::STATUS_BAD_REQUEST);
         }
 
+        // SECURITY: cap the input list. Each URN triggers a parse →
+        // register find → schema find → object find chain, so a 100k
+        // input list = ~400k DB round-trips per request. Currently this
+        // route is effectively admin-only via the absence of
+        // @NoAdminRequired, but a future relaxation would convert the
+        // missing cap directly into a DoS lever.
+        if (count($urns) > 1000) {
+            return new JSONResponse(
+                ['error' => 'Too many URNs (max 1000 per request)', 'count' => count($urns)],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
+
         $resolved = $this->urnService->resolveBulk($urns);
 
         return new JSONResponse(