Qwik: Crashing any Qwik Server via Resource thenable

### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. ### Impact One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests. Source Code Location: https://github.com/QwikDev/qwik Affected Packages: - npm:@builder.io/qwik, affected < 1.20.0, patched in 1.20.0 - npm:@qwik.dev/core, affected < 2.0.0-beta37, patched in 2.0.0-beta37 CWEs: - CWE-248: Uncaught Exception CVSS: - CVSS_V4: score 8.7, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N References: - https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6 - https://nvd.nist.gov/vuln/detail/CVE-2026-84994 - https://github.com/QwikDev/qwik/pull/8655 - https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511 - https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0 - https://github.com/advisories/GHSA-x586-xvc8-g7q6