fix: harden Windows broker security and validation

[ReenigneArcher]

Description

• Extract broker message validation into broker_request_validation.hpp with full field, enum, bounds, string-terminator, and reserved-field checks
• Add unit tests for all validation paths
• Replace blocking pipe I/O with cancellable overlapped I/O with explicit timeouts
• Verify named-pipe server PID matches the SCM-registered running broker before sending any request
• Protect state directory and files with restricted DACLs (LocalSystem/Administrators/broker service only) and reject reparse points
• Use FILE_FLAG_FIRST_PIPE_INSTANCE so a second process cannot squat the pipe name
• Link advapi32 for service and ACL APIs
• Install the MIT LICENSE file to share/licenses/libvirtualhid
• Update docs and license map to cover broker and entitlement/evaluation sources under LB-SAL 1.0

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Unit tests have been added or updated for any new or modified functionality

AI Usage

See our AI usage policy.

• None: No AI tools were used in creating this PR
• Light: AI provided minor assistance (formatting, simple suggestions)
• Moderate: AI helped with code generation or debugging specific parts
• Heavy: AI generated most or all of the code changes

[codecov]

Codecov Report

❌ Patch coverage is 96.57534% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.60%. Comparing base (8e076f3) to head (f22912f).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/platform/windows/windows_broker_client.cpp	89.79%	2 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #66      +/-   ##
==========================================
+ Coverage   74.04%   74.60%   +0.56%     
==========================================
  Files          33       34       +1     
  Lines        7793     7931     +138     
  Branches     2922     2984      +62     
==========================================
+ Hits         5770     5917     +147     
+ Misses       1757     1444     -313     
- Partials      266      570     +304     

Flag	Coverage Δ
Linux-Clang	57.13% <100.00%> (+0.57%)	⬆️
Linux-GCC	67.91% <100.00%> (+0.52%)	⬆️
Windows-MSVC	87.90% <98.86%> (+0.47%)	⬆️
Windows-MinGW-UCRT64	64.56% <95.20%> (+0.98%)	⬆️
macOS	51.18% <100.00%> (+0.89%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/include/libvirtualhid/license.hpp	100.00% <ø> (ø)
...tform/windows/broker/broker_request_validation.hpp	100.00% <100.00%> (ø)
src/platform/windows/windows_broker_client.cpp	86.23% <89.79%> (+21.53%)	⬆️

... and 11 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8e076f3...f22912f. Read the comment docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud