Add borsh serialization support

[sug0]

Add support to serialize maps and sets with borsh.

[sug0]

@cuviper the new deserialization code in spite of working correctly, introduced some exploits related with OOM errors. I'm inclined to rollback to Vec's borsh deserialization code, considering the gains in performance of the new approach are very minute anyway, and their deserialization code already solves the problem at hand. lmk what you think

[cuviper]

introduced some exploits related with OOM errors.

Please explain this! If there's an "exploit" footgun here, it needs to be commented at the very least.

[sug0]

@cuviper hm the problem is this deserialization code I wrote is blindly allocating a buffer for incoming items from a stream. the deserialization code in borsh for collections already guards against OOM related issues by limiting the size of allocations (possibly why it's occasionally slower in the benches I ran).

I'll revert the deserialization code to use Vec::deserialize_from_reader as I had before

[cuviper]

Oh, I see -- I should really add limits to serde size_hint() deserializers as well, as they do in their own impls.

[cuviper]

CI failed on MSRV --all-features, since borsh wants 1.66, so I guess we need to reduce that job to the list of features that do work with 1.63. (I don't want to raise MSRV just for an optional feature.)

[cuviper]

Your branch is not open to maintainer pushes, so I put suggested changes in my fork:
heliaxdev/indexmap@heliax/borsh-support...cuviper:indexmap:borsh-support

[sug0]

@cuviper thanks for the patches! I've included them in this branch

[sug0]

rebased on 2.2.4

[cuviper]

This has been published in 2.2.5!

[sug0]

sweet. thanks!