API entrypoint detection no longer drops functions with comment-like strings

Patch Changes

• c5eeb30: Gate the client-side 900-second maxDuration upper bound behind the VERCEL_CLI_SKIP_MAX_DURATION_LIMIT environment variable. The limit is now owned by a single helper in @vercel/build-utils instead of being hardcoded in multiple validators. When the variable is set to 1, the client-side maximum is skipped and validation defers to the server. Default behavior is unchanged — the maximum, the lower bound, and the integer check are all still enforced when the variable is unset.
• 09c39af: Fix Node.js API entrypoint detection dropping functions whose source contains comment-like sequences (/*, //, */) inside string, template, or regex literals — for example an Accept: */* header. Handler exports are now identified with the ES/CJS module lexers instead of stripping comments with regexes, so the contents of literals are never mistaken for comments.