Limit nesting depth

[liggitt]

This allows callers to limit input size to bound allocations / CPU, without needing to introspect the provided JSON to protect against internal decoder stack depth overflow.

See also https://tools.ietf.org/html/rfc7159#section-9 and golang issue 31789

[codecov]

Codecov Report

Merging #410 into master will increase coverage by 4.8%.
The diff coverage is 68.35%.

@@            Coverage Diff            @@
##           master     #410     +/-   ##
=========================================
+ Coverage   81.72%   86.53%   +4.8%     
=========================================
  Files          41       41             
  Lines        5029     5102     +73     
=========================================
+ Hits         4110     4415    +305     
+ Misses        798      551    -247     
- Partials      121      136     +15

Impacted Files	Coverage Δ
reflect.go	92.85% <100%> (+0.14%)	⬆️
iter_array.go	76.59% <100%> (+2.78%)	⬆️
reflect_struct_decoder.go	81.89% <33.33%> (+33.56%)	⬆️
iter_object.go	67.89% <88.88%> (+1.41%)	⬆️
iter.go	90.09% <94.11%> (+0.35%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 819acad...eec2489. Read the comment docs.

[liggitt]

cc @taowen

[liggitt]

thanks! just for planning purposes, is there a target date for tagging a release that will include this?

[taowen]

https://github.com/json-iterator/go/releases/tag/1.1.8

[liggitt]

just noticed the new tag is missing a leading v: #412