[Backport request] CVE-2024-10964 — strcpy buffer overflow in plugin_handle.c not backported to v2.9

Hi @emqx maintainers,

While reviewing security backports across `v2.x` branches I noticed that the upstream fix for **CVE-2024-10964** (commit [3e3a583d](https://github.com/emqx/neuron/commit/3e3a583d7254)) does not appear to be present on the `v2.9` branch.

## Evidence

- Upstream fix on `main`: `strcpy(cmd.library, req->library)` → `strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN)` in both `handle_add_plugin()` and `handle_update_plugin()` of `plugins/restful/plugin_handle.c`.
- `v2.9` HEAD (`72cab4a0c815`) still contains the vulnerable lines:
```c
void handle_add_plugin(nng_aio *aio) {
...
strcpy(cmd.library, req->library); // CVE-2024-10964 unbounded copy
...
}
void handle_update_plugin(nng_aio *aio) {
...
strcpy(cmd.library, req->library); // CVE-2024-10964 unbounded copy
...
}
```
- `compare v2.9...main`: status=diverged, ahead=592, behind=139 — so a maintained branch.
- No commit on `v2.9` matching the upstream title `plugin:buffer overflow`.

A minimal backport is just the two `strcpy → strncpy` lines (the upstream patch is `+2/-2`); the surrounding `otel_trace_type` lines from the master fix are not present on `v2.9` and can be dropped.

Would you consider cherry-picking (or applying the equivalent two-line change) onto the `v2.9` maintenance branch?

Thanks!