security: remediate GO-2026-6115 in github.com/ledongthuc/pdf #928

CI currently fails make vulncheck on reachable calls from internal/imageinput/pdf.go to github.com/ledongthuc/pdf (pdf.NewReader and Reader.GetPlainText). The Go vulnerability database reports no fixed version for this fork, so a dependency version bump cannot remediate it. Replace the PDF text-extraction implementation with a maintained non-affected alternative, preserve extraction/page-count behavior, add hostile-PDF resource-limit coverage, and verify make vulncheck is clean.