Security fixes for CBOR parser, TLS default, and URI logging

[jguz-pubnub]

fix: bound CBOR decoder against DoS via untrusted tokens

Pubnub::Cbor now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching Pubnub::Client#parse_token raise Pubnub::Cbor::DecodeError instead of hanging the caller or triggering SystemStackError.

fix: default DEFAULT_SSL to true so requests use https by default

Pubnub::Constants::DEFAULT_SSL flipped from false to true. Integrators must now opt out explicitly to send traffic in cleartext.

fix: redact signature and pnsig values from Requested URI debug log

The Requested URI debug entry in Pubnub::Event#uri now masks the signature and pnsig query parameter values, per the SDK log practices ADR. auth and token remain visible at DEBUG since they are permitted URL parameters.

test: rewrite recorded VCR cassette URIs from http to https so requests match under the new TLS default

[pubnub-ops-terraform]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[jguz-pubnub]

The default setting for production is TLS-on. Regarding the test suite, currently recorded VCR cassettes are linked to http://ps.pndsn.com, and VCR matches the full URI, including the http: scheme. This update is to avoid editing over 10,000 .yaml fixture files, which would be overwhelming for reviewers and make it harder to notice changes in the source code under lib/pubnub

The new PR removing ssl: false and fixing all the VCR cassettes should follow the current one.

[mohitpubnub]

👍🏻

[mohitpubnub]

LGTM