harden the LibreOffice profile, flags, and timeout kill

Problem (defense-in-depth)

The LibreOffice subprocess used to render legacy Office formats and DrawingML/EMF/chart content (docling/backend/docx/drawingml/utils.py) runs against user-supplied documents with a throwaway profile that relies on implicit defaults. It does not explicitly set the macro security level, disable automatic link updates, or add the usual non-interactive hardening flags. Additionally, subprocess.run(timeout=...) only signals the direct child, so on Linux a hung soffice.bin can survive the timeout.

Proposed fix

Seed the throwaway profile's registrymodifications.xcu with macro security set to maximum, macros disabled, and link-update off; add --norestore --nologo --nolockcheck --nodefault; and launch in a new process group so the whole group can be killed on timeout. Also wire up the documented DOCLING_LIBREOFFICE_CMD env var (currently referenced in a message but not read).

A PR implementing this follows.