Make R SDK CRAN-conformant via vendored source build

[clemensv]

Make the R SDK CRAN-conformant (vendored source build)

Why

The R package previously downloaded a prebuilt libjson_structure shared
library from GitHub Releases at install / first load. CRAN forbids
install-time and runtime network access, so that model could never pass
R CMD check --as-cran and the package could not be published. This PR
refactors the package to be self-contained and built from source on every
platform.

What changed

Vendored source build (no runtime download)

• Vendor the JSON Structure C engine translation units, the public headers
  under r/src/json_structure/, and cJSON v1.7.18 (MIT, © Dave Gamble)
  into r/src/. The package now compiles the engine at install time.
• cJSON attribution recorded in r/inst/COPYRIGHTS.
• New r/tools/vendor-engine.R re-syncs the engine .c/headers from c/
  into r/src/ (excluded from the tarball via .Rbuildignore).
• Removed the runtime binary installer (R/binary_installer.R + its docs) and
  the download/dlopen path in ffi.R/zzz.R.

Windows std::regex deadlock → pure-C matcher

MinGW libstdc++ std::regex deadlocks on first use whenever its DLL is
loaded by R on Windows (lazy locale init via __gthread_once under the
fully-static Rtools toolchain). It is unfixable by link flags, static/shared
runtime selection, or thread warmups — and CRAN mandates that exact static
toolchain.

• Replace the vendored regex_utils.cpp with regex_utils.c, a
  self-contained ECMAScript-subset backtracking matcher: pure C, no
  threads/TLS, char-class bitmaps, greedy/lazy quantifiers, anchors, word
  boundaries, escapes, groups, alternation. Invalid/unsupported constructs
  (lookbehind, named groups, inline flags, \p{…}, lookahead) are rejected
  as invalid, matching std::regex's throw-on-parse behavior. ReDoS is
  bounded by a step budget.
• The package is now pure C — no libstdc++ dependency at all.
• The upstream C SDK (c/src/regex_utils.cpp) is unchanged; only the R
  vendored copy differs. regex_utils.h documents the split.

C engine (shared source of truth)

• Replace three bounded snprintf copies in c/src/instance_validator.c and
  c/src/schema_validator.c with memcpy to silence -Wformat-truncation,
  so the vendored build stays warning-free after any re-sync. C SDK tests
  unaffected (all pass).

Build / CI / docs

• Makevars: Unix keeps $(SHLIB_PTHREAD_FLAGS) for the engine's allocator
  lock; Makevars.win links nothing extra (SRWLOCK from kernel32). No C++.
• .github/workflows/r.yml: a single source-build matrix over
  ubuntu / macos / windows; R CMD check with --as-cran and error-on
  warning; the shared corpus is exercised via JSONSTRUCTURE_TEST_ASSETS.
  The separate C-build and Windows jobs are removed.
• README / NEWS / cran-comments updated and man/ regenerated for the
  pure-C, source-build model.

Validation

R CMD check --as-cran --no-manual on a fresh tarball:

Status: 2 NOTEs
  * New submission (Maintainer: Clemens Vasters <clemensv@microsoft.com>)
  * pragma(s) suppressing diagnostics: 'src/cJSON.c'

0 errors, 0 warnings, 2 notes (both expected and documented in
cran-comments.md). The shared test-assets/ corpus runs during the check:
[ FAIL 0 | WARN 0 | SKIP 1 | PASS 74 ] (the single skip is the optional
primer-samples directory, not shipped in the tarball). Verified as a pure-C
build (all gcc, no g++/libstdc++) and with no Windows regex hang.

Notes

• No CRAN submission is performed by this PR; it makes the package
  conformant so a future submission (or r-universe) is possible.