libtest: crafted terminfo color capability can cause large allocation during test output

I tried this code:

#[path = "library/test/src/term/terminfo/parm.rs"]
mod parm;

fn main() {
    let cap = b"%p1%100000000d";
    let out = parm::expand(
        cap,
        &[parm::Param::Number(1)],
        &mut parm::Variables::new(),
    )
    .unwrap();

    println!("cap_len = {}", cap.len());
    println!("out_len = {}", out.len());
}

libtest loads terminal color capabilities from the terminfo entry selected by
TERM, TERMINFO, or TERMINFO_DIRS. If that entry contains a crafted setaf
capability, libtest can allocate and write a very large buffer while printing
normal colored test output.

The minimal crafted capability is %p1%100000000d. It expands to a 100 MB
padded buffer. This is output-size amplification rather than superlinear CPU
complexity, but it can still cause denial of service in CI or test environments
where a crafted terminfo entry is loaded by a Rust test binary.

Meta

rustc --version --verbose:

61d7280f3c4c63fa24c56bdaa9a446151b5a30dc

cap_len = 14
out_len = 100000000

Start with library/test/src/term/terminfo/parm.rs, especially expand, and reproduce the reported capability with the provided Rust example. Trace how libtest uses the expanded color capability during test output. Done means the crafted capability no longer causes an unexpectedly large allocation while normal capability expansion remains functional.