security: cap Horizon balances array size and harden response validation

[Faithy5]

Summary

• cap Horizon balance payloads at a documented maximum before scanning for a USDC trustline
• reject oversized balances arrays with INVALID_RESPONSE
• preserve existing ACCOUNT_NOT_FOUND and REQUEST_FAILED handling
• add regression tests for oversized, at-cap, and missing-balance responses

Testing

• npx vitest run src/utils/__tests__/horizon.test.ts

Closes #495

[drips-wave]

@Faithy5 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[GBOYEE]

@GBOYEE has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Audit the security surface, implement defense-in-depth fix with proper error handling, add tests verifying the fix.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @GBOYEE to this issue.