@std/yaml parse silently misparses documents with tab indentation instead of rejecting them #7359

Describe the bug

YAML forbids tab characters in indentation (spec 6.1). Parsers are expected to reject such documents. @std/yaml's parse accepts them and returns a silently wrong structure: the tab-indented key floats to the top level and its parent becomes null.

Reproduction

import { parse } from "jsr:@std/yaml";

parse("a:\n\tb: 1");
// -> { a: null, b: 1 }
// spec-compliant parsers (js-yaml, PyYAML, the `yaml` npm package) all raise
// "tab characters must not be used in indentation"

parse("a:\n  b:\n\tc: 2");
// -> { a: { b: null }, c: 2 }
// c escapes its parent mapping and b is nulled

parse("a:\n \tb: 1");      // space then tab
// -> { a: { b: 1 } }   (accepted, should error)

parse("- a\n-\tb");
// -> [ "a", "b" ]       (accepted, should error)

Impact

Anyone parsing user-supplied YAML (config files, front matter, CI definitions) gets no error and a corrupted document: nested keys silently move to the top level and values turn into null. That is worse than rejecting, because the parse "succeeds" and the wrong config is used downstream.

Expected behavior

Throw a YAMLParseError (or equivalent) when a tab is used as indentation, matching the YAML spec, upstream js-yaml (tab characters must not be used in indentation), and PyYAML.

Environment

• @std/yaml 1.3.0 (via JSR)
• Node 22 for the harness; the code path is engine-independent