Use safe_parse for JSON decoding in NdjsonReader

What does this MR do and why?

Replaces Gitlab::Json.parse with Gitlab::Json.safe_parse in NdjsonReader#json_decode to enforce streaming validation limits during project and group file-based imports.

safe_parse runs the input through StreamValidator before parsing, which protects against maliciously crafted or corrupt export archives containing:

• Deeply nested JSON structures (limit: 32 levels; real exports reach ~6)
• Oversized arrays or hashes (limit: 50,000 entries each)
• Excessive total elements (limit: 100,000)
• Large JSON documents (limit: 20 MB)

This affects both consume_attributes (parses tree/project.json) and consume_relation (parses each line of tree/project/*.ndjson files).

• Closes #586073

References

• Gitlab::Json.safe_parse implementation: json.rb
• StreamValidator: stream_validator.rb

How to set up and validate locally

1. Run the NdjsonReader specs:

   bundle exec rspec spec/lib/gitlab/import_export/json/ndjson_reader_spec.rb

2. Run relatin tree restorer specs to verify end-to-end import:

bundle exec rspec spec/lib/gitlab/import_export/project/relation_tree_restorer_spec.rb

1. Optionally, test with a real project export:
   1. Export a project via Settings > General > Advanced > Export project
   2. Extract the archive and inspect tree/project.json and tree/project/*.ndjson files
   3. Re-import to verify the import completes without Incorrect JSON format errors

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.