[Security] Limit stdin read size in readStdinString

[gonzaloriestra]

WHY are these changes introduced?

The readStdinString function was reading all data from standard input without any size limitations, which could lead to memory exhaustion and Denial of Service (DoS) if processing untrusted or excessively large input.

WHAT is this pull request doing?

Introduces a 10MB limit to readStdinString. It now tracks total bytes read and throws an AbortError if the limit is exceeded.

How to test your changes?

Run the unit tests for cli-kit:
pnpm --filter @shopify/cli-kit run vitest src/public/node/system.test.ts

Duplicate check

Query: gh pr list --repo Shopify/cli --state all --limit 200 --search 'label:"Jules" "Security" in:title' --json number,title,state,url,body,files (Note: gh was unavailable, so git log was used as fallback).

Closest prior PRs:

1. f4de6ef1a: [Security] Fix command injection in treeKill utility - Different subsystem (process management) and vulnerability class (command injection).
2. e00baf901: [Security] Fix command injection risk in cloudflared installer - Different subsystem and vulnerability class.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact

---

PR created automatically by Jules for task 10535475246681127260 started by @gonzaloriestra

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.