feat: strict mode for parseJsonStrings (fail or redact on parse failure)

[ioncache]

Summary

When parseJsonStrings: true is set and the input string is not valid JSON, sanitizeData silently falls back to text-based pattern matching. Callers who expect JSON but receive malformed input may get incomplete sanitization without knowing it — specifically, numeric-valued sensitive fields are not masked on the regex path.

Proposed behavior

A parseJsonStringsStrict option (or similar) that, when JSON.parse fails, either:

• Throws — signals the unexpected input so the caller can handle it
• Redacts — masks the entire string rather than falling back to regex

Current behavior

// malformed JSON silently falls back to regex — numeric value not masked
sanitizeData('{"password":12345,invalid}', { parseJsonStrings: true });
// => '{"password":12345,invalid}' (numeric value not masked)

Notes

• The fallback is documented in the README as of v1.4.1
• This is tracked in docs/ROADMAP.md under "Collect Usage Signals Before Implementing"
• Opening this issue to gauge demand before adding API surface area

If this affects you, please comment with your use case.