harden the LibreOffice profile, flags, and timeout kill

### Problem (defense-in-depth)

The LibreOffice subprocess used to render legacy Office formats and DrawingML/EMF/chart content (`docling/backend/docx/drawingml/utils.py`) runs against user-supplied documents with a throwaway profile that relies on implicit defaults. It does not explicitly set the macro security level, disable automatic link updates, or add the usual non-interactive hardening flags. Additionally, `subprocess.run(timeout=...)` only signals the direct child, so on Linux a hung `soffice.bin` can survive the timeout.

### Proposed fix

Seed the throwaway profile's `registrymodifications.xcu` with macro security set to maximum, macros disabled, and link-update off; add `--norestore --nologo --nolockcheck --nodefault`; and launch in a new process group so the whole group can be killed on timeout. Also wire up the documented `DOCLING_LIBREOFFICE_CMD` env var (currently referenced in a message but not read).

A PR implementing this follows.

Read docling/backend/docx/drawingml/utils.py and trace the LibreOffice subprocess setup, starting with the documented DOCLING_LIBREOFFICE_CMD reference. Done means the throwaway profile applies the requested macro and link settings, the non-interactive flags and process-group timeout behavior are present, and the environment variable is actually used.

Written by the indexing model from the issue text.