fix(referrer): apply default page size when request has no pagination

[waveywaves]

Summary

Fixes #2890.

The ReferrerService.DiscoverPrivate and DiscoverPublicShared endpoints return an unbounded number of direct references (SBOMs, SARIF reports, …) when a client sends an empty pagination field. A container image that is attested repeatedly accumulates these references over time, so a single call can return hundreds of items.

Root cause

referrerPaginationOptsFromProto in app/controlplane/internal/service/referrer.go returned (nil, nil) whenever the request's pagination was nil, and the data layer treated nil *CursorOptions as "skip pagination entirely":

```go
// app/controlplane/pkg/data/referrer.go (unchanged)
if p != nil {
q = q.Limit(p.Limit + 1)
// …
}
```

This was intentional "backward compatibility" per the helper's comment, but it is the bug the issue describes.

Fix

Always return *pagination.CursorOptions with the existing defaultReferrerPageSize = 20:

• nil request → default page size
• empty request → default page size
• Limit: 0 → default page size
• explicit Limit: N → honored as-is (still capped at 100 by the proto validation rule)

The biz-layer traversal is still bounded by maxTraverseLevels = 1 (app/controlplane/pkg/data/referrer.go:196), so level-0 refs are now bounded and nothing deeper needs a change.

Client impact

• CLI: unaffected. app/cli/cmd/referrer_discover.go already sends a non-nil pagination request with DefaultLimit: 20.
• Raw gRPC/REST clients: the default response now contains at most 20 direct references. Clients that want more must pass pagination.limit explicitly (up to 100) or page through with pagination.cursor. This is a behavior change but it is the fix the issue asks for.

Test plan

• go test ./internal/service/... -run TestReferrerPaginationOptsFromProto -v — 5 subtests covering nil / empty / zero / explicit / boundary limit
• go test ./internal/service/... — full service package passes
• go vet ./internal/service/... clean
• gofmt -l clean
• Commits GPG-signed and DCO signed-off