GHSA-24c8-4792-22hx

## Summary `ArrayFunctions.InsertAt` in Scriban allocates `index - list.Count` null entries in a tight C# `for` loop with no bound on `index`. The function is exposed to template authors as `array.insert_at`, and the fill loop ignores every existing safety control: `LoopLimit`, `LimitToString`, `ObjectRecursionLimit`, and `RecursiveLimit`. A single template such as `{{ [1] | array.insert_at 200000000 'x' | array.size }}` causes `OutOfMemoryException` in well under a second on a host with 1 GB of memory, even when `LoopLimit` is set to `10` and `LimitToString` is set to `100`. Because `OutOfMemoryException` is generally not caught by the template renderer or by typical host applications, the vulnerability terminates the host process, not just the template. This is a sibling vector to GHSA-xw6w-9jjh-p9cr / GHSA-c875-h985-hvrc / GHSA-v66j-x4hw-fv9g, which patched comparable unbounded primitives in `string * int`, `array.size`, `array.join`, `string.pad_left`, and `string.pad_right`. The 7.0.0 hardening pass (`dde661d` "Apply LoopLimit to internal iteration paths" and `4227fde` "Harden string padding width limits") swept the equivalent loops in `ArrayFunctions` and `StringFunctions` but missed `InsertAt`. ## Details Reproducible in 7.1.0 (latest tag) and on `master` at `c8094b0`. `src/Scriban/Functions/ArrayFunctions.cs:369-386`: ```csharp public static IEnumerable InsertAt(IEnumerable? list, int index, object? value) { if (index < 0) { index = 0; } var array = list is null ? new ScriptArray() : new ScriptArray(list); // Make sure that the list has already inserted elements before the index for (int i = array.Count; i < index; i++) { array.Add(null); // <-- unbounded fill, no StepLoop, no Limit* } array.Insert(index, value); return array; } ``` The function is registered as the template builtin `array.insert_at` (`array.fmt-cs` and the standard `ArrayFunctions` ScriptObject reflection registrat