Scriban: Array multiplication operator missing LoopLimit check enables DoS via excessive allocation

The array multiplication operator (`array * integer`) in Scriban allocates a result array of size `intModifier * array.Count` without consulting `LoopLimit` or using overflow-safe arithmetic, allowing a small template to trigger multi-gigabyte allocations and denial of service.

Any application that renders attacker-controlled Scriban templates, including those using `object.eval` or `object.eval_template`.

Apply the suggested remediation: add a `LoopLimit` check or overflow-safe pre-check in `ScriptArray.cs` for the Multiply case, and add a regression test.