[BUG]: Unbounded resource consumption in web_core processing

# Unbounded resource consumption in web_core processing

Repository: https://github.com/a2ui-project/a2ui
Affected: `@a2ui/web_core` (v0.9 paths)
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

Three separate unbounded-growth paths exist in the processing core:

1. `updateComponents` component arrays are validated with `.min(1)` but have no maximum — an agent can send arbitrarily large arrays per message or per surface.
2. `Intl.NumberFormat` instances are cached permanently, keyed by agent-supplied `currency` + `decimals` values (`basic_functions.ts:282-344`) — an unbounded cache keyed on untrusted input.
3. DataModel descendant notifications are O(n²) in the number of bound paths (`data-model.ts:326-330`).

## Impact

A malicious or misbehaving agent can inflate memory use and CPU time over the lifetime of a session. Degradation is gradual rather than an immediate crash; availability only.

## Suggested remediation

- Cap components per message and per surface.
- Replace the formatter cache with an LRU bound.
- Index notification paths to avoid quadratic descendant scans.

The issue points to three specific files: `basic_functions.ts` lines 282-344 for the Intl.NumberFormat cache, `data-model.ts` lines 326-330 for O(n²) notifications, and the `updateComponents` validation. Start by examining these files to understand the current implementations. Look for existing tests related to these functions. 'Done' means each of the three vulnerabilities is addressed: capping array sizes, implementing an LRU cache, and indexing notification paths.

Written by the indexing model from the issue text.