fix(security): add 5-second execution timeout for custom access token scripts

[lakhansamani]

Summary

• Add 5-second execution timeout to the Otto JS VM used for custom access token scripts
• Prevents DoS via infinite loops or CPU-intensive scripts set by admins
• Extracted shared runCustomAccessTokenScript helper used by both CreateAccessToken and CreateIDToken
• Uses vm.Interrupt channel with a goroutine timer; done channel prevents goroutine leaks
• On timeout, custom claims are skipped gracefully (logged as error) rather than crashing

Files Changed

• internal/token/auth_token.go — extracted helper with timeout mechanism

Test plan

• make test-sqlite passes (no regressions)
• Verify custom access token scripts still execute normally
• Verify scripts exceeding 5 seconds are terminated gracefully