(fix): Replace unsafe expression evaluation with safe recursive-descent parser in VegaDeclarativeChart

[AtishayMsft]

Previous Behavior

New Behavior

• Replace new Function() calls in VegaLiteSchemaAdapter with a safe recursive-descent expression evaluator that only supports the Vega-Lite expression subset
• Add JSON depth validation at the component boundary to prevent stack overflow / memory exhaustion from deeply nested specs
• Add 44 security-focused unit tests and 4 end-to-end component tests reproducing the reported attack payloads

Related Issue(s)

• Fixes #

[github-actions]

📊 Bundle size report

✅ No changes found

[github-actions]

Pull request demo site: URL

[Hotell]

Should I close my proposed fix ? #35851

as I mentioned on the issue, having full tokenizer in runtime might be a bit of a huge tax to pay. the use strict approach with regex should be good enough

[AtishayMsft]

Should I close my proposed fix ? #35851

as I mentioned on the issue, having full tokenizer in runtime might be a bit of a huge tax to pay. the use strict approach with regex should be good enough

The tokenization is needed for only the transform set which is pretty small. We should be good with this.