fix(scripting): block ThreadPool/Timer/AssemblyLoadContext in sandbox

Core.Scripting-012 (High, Security) resolution.

The Core.Scripting-008 rewrite broadened the BCL references list from a
narrow allow-list to the full System.* + netstandard +
Microsoft.Win32.Registry set, delegating the security gate entirely to
ForbiddenTypeAnalyzer. Three categories of dangerous BCL types were
reachable from script source without a deny-list entry:

  - System.Threading.ThreadPool — QueueUserWorkItem re-introduces the
    background-fanout threat Core.Scripting-003 closed against
    System.Threading.Tasks.
  - System.Threading.Timer — schedules unbounded callback work that
    outlives the per-evaluation timeout.
  - System.Runtime.Loader.AssemblyLoadContext — loads arbitrary DLLs.
    Defense-in-depth gap; invocation needs reflection (already denied)
    but the load itself was reachable.

Fix:
  - Added 'System.Runtime.Loader' to ForbiddenNamespacePrefixes
    (preferred over type-granular per the recommendation so future BCL
    additions to that namespace are denied by default).
  - Added 'System.Threading.ThreadPool' and 'System.Threading.Timer'
    to ForbiddenFullTypeNames — both live in System.Threading shared
    with allowed primitives so they must be type-granular.

Regression tests added to ScriptSandboxTests:
  Rejects_ThreadPool_QueueUserWorkItem_at_compile
  Rejects_Timer_new_at_compile
  Rejects_AssemblyLoadContext_at_compile

Docs:
  docs/v2/implementation/phase-7-scripting-and-alarming.md decision #6
  and the Sandbox-escape compliance-check row both updated to enumerate
  the new entries per the Core.Scripting-009 doc-sync convention.

Two lower-impact suggestions from the finding's recommendation
(System.Console, CultureInfo.DefaultThreadCurrentCulture) were
intentionally not addressed and are recorded as accepted minor risks
in the resolution.

Verification: Core.Scripting.Tests 107/107 (was 104 + 3 new rejection
tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ForbiddenTypeAnalyzer.cs

@@ -72,6 +72,11 @@ public static class ForbiddenTypeAnalyzer
                                         // a Task fan-out outlives the evaluation timeout entirely
                                         // (Core.Scripting-003).
         "System.Runtime.InteropServices",
+        "System.Runtime.Loader",        // AssemblyLoadContext + AssemblyDependencyResolver —
+                                        // arbitrary DLL load into the host process
+                                        // (Core.Scripting-012). Namespace-prefix rather than
+                                        // type-granular so future BCL additions to this
+                                        // namespace are denied by default.
         "Microsoft.Win32",              // registry
     ];
 
@@ -113,6 +118,24 @@ public static class ForbiddenTypeAnalyzer
         // target it without blocking those legitimate types. Denied type-granularly here.
         // (Core.Scripting-010.)
         "System.Threading.Thread",
+        // Core.Scripting-012 — broadening the references list to the BCL trusted-platform-
+        // assemblies set (Core.Scripting-008 follow-up) re-exposed two background-work
+        // vectors the original deny-list missed. Both live in System.Threading (shared
+        // with allowed sync primitives like CancellationToken / SemaphoreSlim), so they
+        // must be denied type-granularly:
+        //
+        //   System.Threading.ThreadPool — QueueUserWorkItem / UnsafeQueueUserWorkItem
+        //                                 re-introduce the background-fanout threat
+        //                                 Core.Scripting-003 closed against
+        //                                 System.Threading.Tasks.
+        //   System.Threading.Timer      — Timer(callback, …) schedules unbounded work
+        //                                 that outlives the per-evaluation timeout.
+        //
+        // System.Runtime.Loader.AssemblyLoadContext is also covered, but at the namespace-
+        // prefix level above (System.Runtime.Loader) so future BCL additions to that
+        // namespace are denied by default.
+        "System.Threading.ThreadPool",
+        "System.Threading.Timer",
     ];
 
     /// <summary>