check MAX_UPVALUEES before adding an upvalue - #1088

Base: upstream wren-lang/wren @ 99d2f0b (fork main), tree previously
vendored as a depth-1 clone with .git stripped.

Delta (10 files, all in src/vm/): security backports of upstream
PRs wren-lang#1242-1246 (OOB/BOF clamps), fixes for wren-lang#1234 (runtimeError upvalue
leak), wren-lang#1212 (lazy string hashing), wren-lang#1141 (sort middle pivot), wren-lang#1056
(cyclic-print truncation), wren-lang#676 (createForeign stackTop), wren-lang#1036/wren-lang#1034/
wren-lang#1033 (error-message bounds), wren-lang#811 (unbound foreign ctor), wren-lang#1236
(fiber-stack UAF), wren-lang#1230 (String.find table), wren-lang#1088 (upvalue bound),
wren-lang#1102 (Range.contains), wren-lang#1228 (lexer overrun), wren-lang#814 (hex-escape UB),
wren-lang#897 (shift UB), wren-lang#1232/wren-lang#1233 (fromString/u64), wren-lang#803 (any/all Bool),
wren-lang#1000 (error hygiene), wren-lang#1012/wren-lang#1068 (warning hygiene), wren-lang#1231/wren-lang#1229
(error-path consistency), plus feurhax hardening (GC-rooted attribute
copy, MAX_NEST_DEPTH=512 parser cap, call-handle arity clamp) and the
64MB heap-cap / perf-audit follow-ups.

Full per-fix archaeology lives in the consumer tree at
feurhax-client/third_party/VENDORED.md (wren section). Built with
WREN_OPT_META=0 WREN_OPT_RANDOM=0; scripting_test + script_editor_test
green.