milter: the sender check keeps two From: and two Sender: values (audit M5)

Security audit 2026-10-17, finding M5 (low), stage 0. senderSession.Header
appended every From:/Sender: value; Postfix bounds one header at 60 000
bytes but not their number, and the signer's 1 MiB cap runs after the
sender check, so an application could make it hold megabytes per
connection (the reader's test: a hundred lines, 6 MB). judge needs only
none / one / more, so two of each are kept; the refusal text joins what is
kept, as before.

Tests: "a hundred From: lines" in the judgement table (refused, more than
one From: line); TestSenderKeepsTwoFromAndSenderLines. go test
./internal/milter.

Docs: security.md (the sentence "a few headers each"); CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -704,8 +704,8 @@ the argument.
   tail may hold none of the neutered characters and each SASL field is one
   word (a `.*` SASL tail would have let a quoted sender spell the whole
   tail); TestInboundRecipientCannotWriteTheRow.
-- [ ] **M5.** Keep at most two `From:`/`Sender:` values; security.md:810
-  reworded. — **Opus**, 0.5 h.
+- [x] **M5.** Keep at most two `From:`/`Sender:` values; security.md:810
+  reworded. — **Opus**, 0.5 h. *Done 2026-10-17:* TestSenderKeepsTwoFromAndSenderLines.
 - [ ] **A4.** Duplicate-cookie line through `loggedPath`. — **Sonnet**, 0.25 h.
 - [ ] **S6.** `smtpd_etrn_restrictions = reject`, `smtpd_discard_ehlo_keywords
   = etrn` in postfix-config.sh; architecture.md § Postfix one line. Done when