Use DI parser in AllowedIncludesAttribute

AllowedIncludesAttribute.OnActionExecuting (line 64) calls JsonApiQueryParser.Parse directly, bypassing the QueryComplexityAnalyzer.Validate step that runs in IJsonApiQueryParser. Two issues:

1. Filter limits (count, depth, value length) are not enforced for actions decorated with [AllowedIncludes].
2. The same request is parsed twice (once in the attribute, once in the controller).

Acceptance criteria

• Attribute resolves IJsonApiQueryParser from context.HttpContext.RequestServices
• Parsed QueryParameters is stashed (e.g. on HttpContext.Items) and reused by the controller
• New test: a request with a filter tree exceeding JsonApiOptions.MaxFilters returns 400 on a [AllowedIncludes] action
• Existing [AllowedIncludes] integration tests still pass