builtin: enforce MemoryBudget for split and splitAfter

[thesmartshadow]

Summary

Fixes a MemoryBudget bypass where allocation-heavy builtins compiled via OpCall* were not accounted, allowing large heap allocations despite a small vm.VM.MemoryBudget.

What changed

• Convert split and splitAfter from Func → Safe so allocations are charged via OpCallSafe + vm.memGrow.
• Add regression tests to ensure MemoryBudget blocks large split/splitAfter outputs.

Why

split/splitAfter can produce very large slices from attacker-controlled input (common in rule engines / policy evaluators). With this change, those allocations are properly budgeted and will return memory budget exceeded when the budget is too small.

Tests

• go test ./...
• Added: TestMemoryBudget_SplitBuiltin, TestMemoryBudget_SplitAfterBuiltin