Ref T13224. For some inputs, Pygments has explosive runtime (e.g., 3+ minutes on a 70-character input to the Bash highlighter).
For now, at least limit the maximum amount of damage this can cause. If pygmentize runs for more than 15 seconds, kill it and decline to highlight the file.
In the future, I'd like to take more steps like: fix the Pygments upstream; port more highlighters to PHP; surface this error to the user explicitly.