Reject unescaped control bytes in JSON strings

The JSON string parser handles escapes and closing quotes, then appends every other byte through the default branch. Raw bytes U+0000 through U+001F are therefore accepted inside quoted strings, including literal newlines and tabs. These bytes must be escaped in JSON. This is separate from the UTF-8 and Unicode-escape decoding work in #351.

Source evidence at the head of #520:

- [utils/src/json.rs:145](https://github.com/wavefnd/Wave/blob/2ae0a91c57fd76323124c0e4dff552adbfadbe1b/utils/src/json.rs#L145) — `fn parse_string`

Acceptance:

- [ ] Reject every unescaped byte from 0x00 through 0x1F inside a JSON string with a normal parse error.
- [ ] Keep the existing escaped newline, tab, carriage return and other supported escapes valid.
- [ ] Add table-driven unit cases covering the full control-byte range in both values and object keys.
- [ ] Keep the dependency-free implementation and coordinate overlapping edits with #351.

API/reference context: [JSON string character restrictions, section 7](https://www.rfc-editor.org/rfc/rfc8259.html#section-7).

Related: #351.

Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.

Start in utils/src/json.rs at fn parse_string around line 145, then run the existing JSON parser tests before changing behavior. Add table-driven coverage for all 0x00–0x1F bytes in values and object keys, while preserving supported escaped controls; done means unescaped bytes produce normal parse errors without adding dependencies.

Written by the indexing model from the issue text.