cbor: Add allocation size limits.
cbor: Add allocation size limits.

Basic checks on field length headers before allocation are a reasonable
precaution against denial of service and out of memory attacks.
(Also, without these checks, we'd readily pass allocation numbers so
large to `make` that it would panic instantly, and that's quite silly.)

This fixes the crashers and panics reported in
https://github.com/polydawn/refmt/issues/23#issue-304485603 .

Further hardening should probably count the rough total of alloc'd
space over time so we can aim for finite memory usage even on outright
antagonistic input.  However, that's a bit trickier, and will also
beg questions about how the cbor half of the library could possibly
make sensible guesses about how much memory e.g. the obj unmarshaller
might translate these tokens into.  This'll come in later commits.

Signed-off-by: Eric Myhre <2346ad27d7568ba9896f1b7da6b5991251debdf2@exultant.us>

polydawn/go-xlate,polydawn/go-xlate,polydawn/refmt,polydawn/refmt