[BUG]: Unbounded resource consumption in web_core processing

# Unbounded resource consumption in web_core processing

Repository: https://github.com/a2ui-project/a2ui
Affected: `@a2ui/web_core` (v0.9 paths)
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

Three separate unbounded-growth paths exist in the processing core:

1. `updateComponents` component arrays are validated with `.min(1)` but have no maximum — an agent can send arbitrarily large arrays per message or per surface.
2. `Intl.NumberFormat` instances are cached permanently, keyed by agent-supplied `currency` + `decimals` values (`basic_functions.ts:282-344`) — an unbounded cache keyed on untrusted input.
3. DataModel descendant notifications are O(n²) in the number of bound paths (`data-model.ts:326-330`).

## Impact

A malicious or misbehaving agent can inflate memory use and CPU time over the lifetime of a session. Degradation is gradual rather than an immediate crash; availability only.

## Suggested remediation

- Cap components per message and per surface.
- Replace the formatter cache with an LRU bound.
- Index notification paths to avoid quadratic descendant scans.