OsvClient: cap fetch_all_pages at MAX_PAGES to avoid unbounded loop

[SAY-5]

Closes #47.

OsvClient#fetch_all_pages (lib/brew/vulns/osv_client.rb:120) loops as long as the OSV response carries a next_page_token, with no upper bound:

while page_token
  payload = original_payload.merge(page_token: page_token)
  response = post("/query", payload)
  vulns.concat(response["vulns"] || [])
  page_token = response["next_page_token"]
end

If the upstream returns a buggy response that echoes the same next_page_token (or unconditionally returns one), the loop concatenates into vulns until the process OOM-kills.

Add a MAX_PAGES = 100 ceiling and raise ApiError with a clear message when the limit is hit, turning the infinite-pagination case into an actionable error. Added a regression test (test_pagination_aborts_after_max_pages) that stubs the server to return the same token forever and asserts the ApiError.

Local verification: Ruby -c syntax check passes for both files. I couldn't run bundle exec rake test locally because system Ruby is 2.6 and Gemfile.lock pins bundler 4.0.6 which requires Ruby >= 3.2 — happy to iterate on the test if CI catches anything.