stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

## Summary The JSONC parser (`stream-json/jsonc/parser.js`) and verifier (`stream-json/jsonc/verifier.js`) scan a comment for its terminator starting from the comment's opening `/` on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and the buffer keeps the whole comment, so the next chunk re-scans everything seen so far. A single comment of length n delivered across many chunks costs O(n²) CPU. This is the same class as GHSA-528h-pc64-c93x (path filters, medium, CWE-407): an algorithmic-complexity re-scan in a streaming feature. It's a different code path though — the comment scanner in `handleComment`, which the 3.5.0 depth cap doesn't touch — so upgrading past that advisory doesn't help here. The plain JSON parser is fine: its strings and numbers advance and drop consumed bytes, and only comments retain and re-scan. ## Proof of concept ``` npm i stream-json@3.5.0 ``` ```js import Parser from 'stream-json/jsonc/parser.js'; function feed(N) { return new Promise(resolve => { const stream = Parser.asStream(); // default options stream.on('data', () => {}); stream.on('error', () => {}); stream.on('end', resolve); const doc = '/*' + 'a'.repeat(N) + '*/1'; // one valid, closed comment for (let i = 0; i < doc.length; i += 16384) // 16 KB pieces, as a socket delivers a body stream.write(doc.slice(i, i + 16384)); stream.end(); }); } ``` Timing the pipeline (Node 22, one core, clean install): a 2 MB comment blo