feat(core-shared): add TanStack Start security header adapter

Exports withSecurityHeaders() and getNonce() from the
./security/tanstack subpath. withSecurityHeaders() returns all six
security headers plus x-nonce for use inside a TanStack/Nitro H3
server middleware; getNonce() reads x-nonce from the node request
headers forwarded by that middleware.

Mirrors the ./security/next adapter pattern while staying free of
any @tanstack/start dependency — the adapter works with plain H3
IncomingMessage types that TanStack Start exposes at wiring time
(Story 09).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/package.json

@@ -23,7 +23,8 @@
     "./instrumentation/sentry/init-client": "./src/instrumentation/sentry/init-client.ts",
     "./instrumentation/sentry/init-client-react": "./src/instrumentation/sentry/init-client-react.ts",
     "./security": "./src/security/index.ts",
-    "./security/next": "./src/security/next/index.ts"
+    "./security/next": "./src/security/next/index.ts",
+    "./security/tanstack": "./src/security/tanstack/index.ts"
   },
   "scripts": {
     "build": "tsc --noEmit",