fix(security): bound SSE frames and NDJSON lines before buffering (#2411)