Reject unescaped control bytes in JSON strings

[LunaStev]

The JSON string parser handles escapes and closing quotes, then appends every other byte through the default branch. Raw bytes U+0000 through U+001F are therefore accepted inside quoted strings, including literal newlines and tabs. These bytes must be escaped in JSON. This is separate from the UTF-8 and Unicode-escape decoding work in #351.

Source evidence at the head of #520:

• utils/src/json.rs:145 — fn parse_string

Acceptance:

• Reject every unescaped byte from 0x00 through 0x1F inside a JSON string with a normal parse error.
• Keep the existing escaped newline, tab, carriage return and other supported escapes valid.
• Add table-driven unit cases covering the full control-byte range in both values and object keys.
• Keep the dependency-free implementation and coordinate overlapping edits with Fix Unicode string decoding in the dependency-free JSON parser #351.

API/reference context: JSON string character restrictions, section 7.

Related: #351.

Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.