chore: exclude potentially dangerous tests by default

[simonresch]

All tests that can perform potentially harmful side effects are tagged and excluded by default. The CI still tests all.

Closes #971

[Copilot]

Pull Request Overview

This PR introduces safety guardrails for potentially dangerous tests by tagging them with "dangerous" and excluding them from local test runs by default. The CI pipeline continues to execute all tests including the dangerous ones.

Key changes:

• Tagged 11 test targets that exercise vulnerable code (deserialization, OS command injection, SSRF, etc.) with "dangerous"
• Modified .bazelrc to exclude "dangerous" tests by default locally while ensuring CI runs all tests
• Added documentation explaining the dangerous test handling and how to run all tests when needed

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sanitizers/src/test/java/com/example/BUILD.bazel	Tagged 9 security-related fuzz tests (deserialization, command injection, SSRF) as "dangerous"
examples/BUILD.bazel	Added "dangerous" tag to SpringCloudFunctionRoutingFuzzer test
CONTRIBUTING.md	Documented the dangerous test tagging system and how to run all tests locally
.bazelrc	Configured default test filters to exclude dangerous tests locally and override in CI

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}