fix(discovery): cap discoveryUrl path length to prevent VLA stack exhaustion

An attacker-controlled discoveryUrl.path component was propagated
without any upper-bound check into a C99 variable-length array inside
UA_Discovery_addRecord. On platforms where UA_STACKARRAY expands to a
true VLA, a RegisterServer request carrying an oversized path causes
the server thread's stack to be exhausted, crashing the process.

pathChars is changed from an attacker-sized stack VLA to a fixed
1024-byte stack buffer, with a bounds check placed directly at its
declaration. The 1024-byte bound exceeds any legitimate mDNS
TXT-record path in practice and is consistent with the 63-char DNS
label limit already enforced for hostname and servername.

Internal Vulnerability Advisory: open62541-SA-2026-0020

Thanks to Chuan Wei [SCU] for the responsible disclosure.

src/server/ua_services_discovery_multicast.c

@@ -508,7 +508,9 @@ UA_Discovery_addRecord(UA_Server *server, const UA_String *servername,
     mdns_set_address_record(server, fullServiceDomain, localDomain);
 
     // TXT record: [servername]-[hostname]._opcua-tcp._tcp.local. TXT path=/ caps=NA,DA,...
-    UA_STACKARRAY(char, pathChars, path->length + 1);
+    char pathChars[1024];
+    if(path->length >= sizeof(pathChars))
+        return UA_STATUSCODE_BADOUTOFRANGE;
     if(createTxt) {
         if(path->length > 0)
             memcpy(pathChars, path->data, path->length);