Fix CodeQL code scanning alerts (#36858)

Fixes 10 CodeQL code scanning alerts:

- Change `NewPagination`/`SetLinkHeader` to accept `int64` for total
count, clamping internally to fix incorrect-integer-conversion alerts
([#110](https://github.com/go-gitea/gitea/security/code-scanning/110),
[#114](https://github.com/go-gitea/gitea/security/code-scanning/114),
[#115](https://github.com/go-gitea/gitea/security/code-scanning/115),
[#116](https://github.com/go-gitea/gitea/security/code-scanning/116))
- Use `strconv.Atoi()` in `htmlrenderer.go` to avoid int64 intermediate
([#105](https://github.com/go-gitea/gitea/security/code-scanning/105),
[#106](https://github.com/go-gitea/gitea/security/code-scanning/106))
- Clamp regex match indices in `escape_stream.go` to fix
allocation-size-overflow
([#161](https://github.com/go-gitea/gitea/security/code-scanning/161),
[#162](https://github.com/go-gitea/gitea/security/code-scanning/162),
[#163](https://github.com/go-gitea/gitea/security/code-scanning/163))
- Cap slice pre-allocation in `GetIssueDependencies`
([#181](https://github.com/go-gitea/gitea/security/code-scanning/181))

---------

Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/charset/escape_stream.go

@@ -61,12 +61,14 @@ func (e *escapeStreamer) Text(data string) error {
 			until = len(data)
 			next = until
 		} else {
-			until, next = nextIdxs[0]+pos, nextIdxs[1]+pos
+			until = min(nextIdxs[0]+pos, len(data))
+			next = min(nextIdxs[1]+pos, len(data))
 		}
 
 		// from pos until we know that the runes are not \r\t\n or even ' '
-		runes := make([]rune, 0, next-until)
-		positions := make([]int, 0, next-until+1)
+		n := next - until
+		runes := make([]rune, 0, n)
+		positions := make([]int, 0, n+1)
 
 		for pos < until {
 			r, sz := utf8.DecodeRune(dataBytes[pos:])