refactor(cache): redesign cache system with structured keys and improved performance

- Add repo_path parameter to cached_response and cached_vec_response functions
- Implement structured cache key format with namespace, repo_path, and request proto
- Replace global cache with Moka in-memory cache using weight-based eviction
- Set 256MB memory cap with 10-minute TTL and 2-minute TTI policy
- Add metrics collection for cache operations and evictions
- Implement efficient repo-scoped invalidation using key structure
- Add detailed documentation comments explaining cache architecture
- Remove outdated dependencies and update dependency versions
- Add error handling for encoding failures in cache operations
- Optimize Vec responses with length-delimited encoding and pre-allocation

archive/get_archive.rs

@@ -22,7 +22,11 @@ impl GitBare {
 
         // Validate revision before spawning (cannot use ? inside spawn_blocking closure)
         let revision = match request.treeish.and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
+            Some(object_selector::Selector::Oid(oid)) => {
+                crate::sanitize::validate_oid_hex(&oid.hex)
+                    .map_err(|e| tonic::Status::invalid_argument(e.to_string()))?;
+                oid.hex
+            }
             Some(object_selector::Selector::Revision(name)) => {
                 crate::sanitize::validate_revision(&name.revision)
                     .map_err(|e| tonic::Status::invalid_argument(e.to_string()))?;
@@ -31,9 +35,18 @@ impl GitBare {
             None => "HEAD".into(),
         };
 
+        let options = request.options.unwrap_or_default();
+        if !options.prefix.is_empty() {
+            crate::sanitize::validate_file_path(&options.prefix)
+                .map_err(|e| tonic::Status::invalid_argument(e.to_string()))?;
+        }
+        for path in &options.pathspec {
+            crate::sanitize::validate_file_path(path)
+                .map_err(|e| tonic::Status::invalid_argument(e.to_string()))?;
+        }
+
         // Spawn the blocking git subprocess in a dedicated thread
         tokio::task::spawn_blocking(move || {
-            let options = request.options.unwrap_or_default();
             let format = archive_options::Format::try_from(options.format)
                 .unwrap_or(archive_options::Format::ArchiveFormatTar);
             let mut args = vec!["archive".to_string()];