fix: opt-in mitigation for React RCE/DoS CVEs (#34676)
This adds opt-in, load-time source patches that neutralize two known
React Server Components vulnerabilities shipped in affected react-server-dom-*
builds: CVE-2025-55182 (RCE), where deserialized model keys are not
filtered and a crafted payload can reach constructor / prototype /
_response, and CVE-2025-55184 (DoS), where a cyclic thenable makes chunk
fulfillment loop forever. The fix rewrites the affected snippets as the
source is loaded, which lets us protect applications that depend on a
vulnerable build without waiting on an upstream package release.
The mitigation is opt-in via the DENO_PATCH_REACT_CVE environment
variable, read once and cached at startup so it cannot be toggled later
from user code. When disabled (the default) the hot path is a single
cached bool check, so there is no cost for the common case. When
enabled, a single \"resolved_model\" substring scan short-circuits the
overwhelmingly common module before any pattern matching runs, and only
JavaScript module source is considered. The patch is wired into all
three module load paths: ESM loading in the CLI, CommonJS-to-ESM translation
in deno_resolver, and require() file reads in ext/node.
