fix(validation): reduce log spam + add OOM guard + check correct mesh for WEIGHTS_0

- DataDrivenItemParser: downgrade animation_bones absence log from INFO to
  DEBUG (was spamming for every item without the optional field)
- GlbValidator: read 12-byte GLB header first and reject files declaring
  totalLength > 50 MB before allocating (prevents OOM on malformed GLBs)
- GlbValidator: WEIGHTS_0 check now uses the same mesh selection logic as
  GlbParser (prefer "Item", fallback to last non-Player) instead of
  blindly checking the first mesh

src/main/java/com/tiedup/remake/v2/bondage/datadriven/DataDrivenItemParser.java

@@ -267,7 +267,7 @@ public final class DataDrivenItemParser {
         if (!root.has("animation_bones")) {
             // Not an error — absent means "permissive" (all owned bones, all animations)
             animationBones = null;
-            LOGGER.info(
+            LOGGER.debug(
                 "[DataDrivenItems] {}: animation_bones not declared — all owned bones enabled for all animations",
                 fileId
             );