security: validate core integer bounds

[EndlessSeeker]

Summary

• parse local rate-limit annotations directly as uint32 values
• reject zero rates, zero burst multipliers, negative/overflowing annotations, and burst multiplication overflow
• parse ZooKeeper endpoint ports with a 16-bit bound and skip invalid, zero, or out-of-range endpoints instead of emitting wrapped port values
• add boundary regression tests for annotation parsing, burst overflow, and invalid ZooKeeper ports

CodeQL coverage

This addresses three open High go/incorrect-integer-conversion alerts in Higress-owned core code: alerts 29, 30, and 5. No finding is dismissed or suppressed.

Validation

• gofmt completed for all changed Go files
• git diff --check passed
• targeted tests were added for both code paths

A local targeted go test invocation was blocked before compilation because the existing generated external/istio tree in this workspace requires Go 1.26 while the repository and CI select Go 1.24. No dependency or generated tree was changed to bypass that mismatch; the clean GitHub CI run is the authoritative test for this PR.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 74.19355% with 8 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@c8b8279). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/ingress/kube/annotations/local_rate_limit.go	74.19%	4 Missing and 4 partials ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4189   +/-   ##
=======================================
  Coverage        ?   50.82%           
=======================================
  Files           ?       88           
  Lines           ?    13431           
  Branches        ?        0           
=======================================
  Hits            ?     6826           
  Misses          ?     6152           
  Partials        ?      453           

Files with missing lines	Coverage Δ
pkg/ingress/kube/annotations/local_rate_limit.go	86.66% <74.19%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.