fix: reject invalid binary form file metadata

[svelte-triage-bot]

Summary

• require binary-form file sizes, timestamps, and offset indices to be safe integers
• reject negative sizes and offset indices before constructing LazyFile values
• cover negative, fractional, NaN, infinite, and unsafe metadata values

Fixes #17147

Testing

• cd packages/kit && pnpm vitest run -c vitest.kit.config.js src/runtime/form-utils.spec.js
• pnpm -F @sveltejs/kit test:unit
• pnpm lint
• pnpm check
• pnpm -F @sveltejs/kit prepublishOnly
• pnpm format
• git diff --check

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 7d8cdb9:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/7d8cdb931ac95a08bb9059e8f725b37afdd797a1

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17149

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7d8cdb9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR