[BUG] Make SocketAddr string parsing safe and reject malformed addresses

[thc1006]

Fixes #4290
Fixes #4291
Refs #4287

This started as the two memory-safety fixes for #4290/#4291 and grew, in response to review, into one address parser shared by both platforms with a clear valid/invalid contract. SocketAddr(char const *) has no in-repo caller (the server uses the (u_long, int) overload), so the stricter failure semantics change no existing call site.

The memory-safety bugs (original scope)

• POSIX terminated the host buffer at a fixed index, so inet_pton read uninitialized bytes for any host shorter than 15 characters.
• Windows bounded the host copy loop with sizeof(buf), a byte count, on a WCHAR[200], so an address over 200 characters wrote past the end.

The fix: one parser for both platforms

Rather than patch two separate paths (POSIX strtol + inet_pton, Windows WSAStringToAddress), both now use the same parser: inet_pton for the host (Winsock has provided it since Vista, via <ws2tcpip.h>) plus a strict decimal port. It parses into a local sockaddr_in and commits it into the storage with memcpy only on success, so a failed parse leaves the object at AF_UNSPEC with port() == -1. This removes the reasons the old Windows path was fragile (WSAStringToAddress returned WSAEINVAL unless sin_family was preset, and Windows CI is build-only so that path was never run) by not using it at all.

It also fixes the contract issues review surfaced:

• A failed parse used to leave a usable 0.0.0.0:<port>; it now leaves AF_UNSPEC, distinguishable from a real endpoint including the legitimate :0.
• An overlong host (255.255.255.2559) used to truncate into a different valid address; it is now rejected.
• The port grammar is decimal digits only with a pre-multiply overflow check, so trailing garbage (80junk, 80:90), a sign or whitespace (+80, -0, 80), and out-of-range values are all rejected on both platforms rather than relying on strtol's locale-sensitive leniency.

Storage layout made explicit

port()/toString() and the parser used to access the sockaddr storage through a sockaddr_in reference (an alignment/type-access issue). They now memcpy a local sockaddr_in in and out. Three static_asserts pin the assumptions this and the socket syscalls rely on: sizeof(sockaddr) == sizeof(sockaddr_in) (IPv4-only, so the length passed to connect()/bind() is exactly right), the address-family field at the same offset, and sizeof(SocketAddr) == sizeof(sockaddr). The (u_long, int) constructor still uses a reinterpret_cast and truncates out-of-range ports; it has an addListeningPort caller, so it is tracked separately rather than changed here.

Build

ws2_32 is declared as an interface dependency of opentelemetry_ext (CMake and Bazel), so consumers and the test inherit it rather than relinking it; the header's #pragma comment(lib) autolink is MSVC-only and MinGW/GCC ignore it.

Tests

socket_tools_test.cc has 17 cases. Failures are asserted through an ExpectInvalid helper that checks both AF_UNSPEC and port() == -1, so a corrupted family byte cannot pass, plus positive cases for a legitimate :0, a leading-zero port (080 parses as 80), the longest representable host, and the truncation, trailing-garbage and sign rejections above.

Verification

• 17 tests pass under -fsanitize=address,undefined.
• inet_pton's rejection of the shorthand (127.1) and leading-zero (01.02.03.004) host forms was confirmed empirically on glibc.
• clang-format, cmake-format (with the repo config) and buildifier clean; clang-tidy 18 on socket_tools.h is unchanged at 2 pre-existing warnings.
• Windows CI is build-only, so a reviewer confirming a real Windows parse would be worth more than my word; using inet_pton at least removes the Windows-specific WSAStringToAddress grammar and its sin_family precondition.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.29%. Comparing base (cf62199) to head (b3fd232).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4292      +/-   ##
==========================================
+ Coverage   81.25%   81.29%   +0.05%     
==========================================
  Files         446      446              
  Lines       18872    18906      +34     
==========================================
+ Hits        15332    15368      +36     
+ Misses       3540     3538       -2     

Files with missing lines	Coverage Δ
...clude/opentelemetry/ext/http/server/socket_tools.h	96.20% <100.00%> (+2.20%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.