Reject NUL-truncated Validator schemas and documents - #250

Validator still accepts a valid JSON prefix followed by an embedded NUL and trailing bytes, both when constructing a schema and when validating a document. This follows up the same parsing completeness problem fixed for loads(), load(), and Decoder in #245. The documented JSONDecodeError contract applies to both Validator inputs too.

Both paths now retain the UTF-8 byte length, parse through a StringStream, and reject unconsumed input using the existing Invalid JSON error. Escaped NULs and valid trailing JSON whitespace continue to work, and schema mismatches still raise ValidationError.

Validation:

• 54 new malformed-input cases fail on the baseline, covering schema/document, str/bytes/bytearray, NUL-only and trailing data, and multibyte UTF-8. Six valid-input controls cover escaped NULs and trailing whitespace.
• Python 3.14.5 compiled extension: full suite 1,260 passed, 17 skipped, 2 xfailed; the skipped tests require a debug Python build. One existing pytz deprecation warning.
• Required Sphinx doctests: 277 passed; one existing missing _static directory warning. A separate commit makes the native-float example portable: it still requires a float and permits only one ULP of rounding difference. The exact-repr example failed identically with a separately rebuilt unchanged baseline; no numeric implementation changed.
• python -m mypy.stubtest rapidjson and git diff --check: passed.
• Built a wheel and installed it into a separate environment. A file-loading consumer passes UTF-8 schemas/documents as text and bytes, checks malformed suffix rejection, escaped NUL preservation, and actual schema-type failure behavior against the compiled extension.

AI assistance: Codex prepared the patch, tests, and description. A separate Codex agent reviewed the final diff and independently ran 67 Validator tests (plus 2 expected failures), all 277 doctests, and the installed-wheel consumer. This is agent review, not human review. Debug Python, sanitizers, other platforms, and hosted CI have not been verified locally.