Smart Contract Diff Audit L-20: Compilation Errors Eagerly Render Unbounded Diagnostic Strings

`CodeBuilder` converts every parse and assembly failure into a `CodeBuilderError` through [`build_error_with_report`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/errors/code_builder_errors.rs#L37-L41), which formats the complete diagnostic report into an owned string at the moment the error is constructed, with no size limit and regardless of whether the caller ever displays it. Both failure paths of [`compile_tx_script`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/code_builder/mod.rs#L539-L553) route through this helper, as do the other compilation entry points of the builder.

The rendered output can grow faster than the source that produced it. The pinned version of `miden-assembly-syntax` batches the semantic errors of a module into a single syntax error holding an uncapped collection of related errors, and the graphical renderer selected by the default `std` feature reprints a source snippet for each one, so a single long line carrying many errors yields output on the order of the error count multiplied by the line length. A caller that exposes MASM compilation to third-party source text would therefore pay disproportionate CPU and memory cost on a failed compile, and would embed the entire rendered diagnostic in log entries. No call site in this repository compiles untrusted text, so the exposure applies to downstream integrators that wire external input into the builder.

Consider enforcing a hard cap on the rendered diagnostic in `build_error_with_report`, for example truncating after a fixed number of bytes or lines, and storing the report so that it is rendered only when displayed, as [`AccountComponentAssemblyError`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-protocol/src/errors/mod.rs#L120-L121) already does in `miden-protocol`. Since `Report` does not implement `core::error::Error` and cannot be held as a source error, the deferred form requires a dedicated field and a `Display` implementation. Documenting that any untrusted compilation boundary must also bound its input size would complement the cap.

---

_Copied verbatim from finding [L-20](https://audits.openzeppelin.com/miden/miden-01-07-smart-contract-diff-audit-nfts/issues/compilation-errors-eagerly-render-unbounded-diagnostic-strings-c0d68353) (low severity) of the OpenZeppelin [smart contract diff audit (NFTs)](https://audits.openzeppelin.com/miden/miden-01-07-smart-contract-diff-audit-nfts). The audit was performed against commit `8411bf093bde25285708faac152b6d7269009617`._