GHSA-c7w3-x93f-qmm8: Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

When a custom envelope object is passed to sendMail() with a size property containing CRLF characters (\r\n), the value is concatenated directly into the SMTP MAIL FROM command without sanitization. This allows injection of arbitrary SMTP commands, including RCPT TO — silently adding attacker-controlled recipients to outgoing emails.