Stop binary writers overflowing the stack on deep values

[nlohmann]

Takes over #5518 by @ayush-singh-0601 (thank you!), rebased on develop and with the open review comments addressed.

to_cbor, to_msgpack, to_ubjson and to_bjdata recursed once per nesting level. Parsing doesn't recurse, so a value the library happily builds could still overflow the stack when serialized. This is the crash in OSS-Fuzz issue 566583014 (parse_cbor_fuzzer, stack overflow in binary_writer::write_cbor).

Each writer now uses the same bounded descent as dump(): it recurses as before up to detail::recursion_depth_limit() levels and writes anything deeper with an explicit heap stack. The output is the same bytes as before.

Commits

1. Stop binary writers overflowing the stack on deep values. The author's commit cf65ac4, cherry-picked with authorship kept and conflicts with develop resolved (write_cbor_head from Remove unreachable branches from the binary writer #5583, to_msgpack_length from Throw instead of writing MessagePack lengths beyond UINT32_MAX #5584, is_bjdata_excluded_type_marker from Stop allocating the BJData excluded-marker list per container #5555). The author's second commit 7301b06 isn't included because it only changed CBOR prefix helpers that write_cbor_head replaces.
2. Redesign the iterative binary writers around a shared recursion depth limit. Addresses the open review comments:
   • Uses detail::recursion_depth_limit() instead of a new limit, and write_cbor_head instead of the CBOR prefix helpers.
   • MessagePack array and map headers are written by one helper per container type, shared by both paths, through to_msgpack_length (out_of_range.412 above UINT32_MAX).
   • Frames hold only containers, and a container's header is written when its frame is pushed, like bson_frame. There is no started flag. The UBJSON frame stores only the value, prefix_required and the iterator.
   • is_bjdata_ndarray() is shared by the recursive path and the iterative path.
   • Discarded values throw type_error.321 on both paths. Strict UTF-8 key checks report the same diagnostics context on both paths.
   • The doc comments refer to the public to_* functions instead of to themselves.
   • Tests: round trips instead of size checks. Byte-exact output at depths limit−1 to limit+2 for CBOR, MessagePack and UBJSON. A deep object, a deep BJData ND-array and a deep discarded value. The OSS-Fuzz regression (200,000 nested arrays) for CBOR and MessagePack.

BSON isn't in this PR. Its writer stopped recursing in #5553.

Verification

• Output is byte-identical to develop on random json and ordered_json values nested 120–140 levels deep, for CBOR, MessagePack, UBJSON and BJData in every use_size/use_type combination.
• 1,000,000-deep arrays and objects serialize with all four writers on a 1 MiB stack.
• unit-large_json.cpp passes in C++11 and C++17 on a 1 MiB stack. No -Weverything warnings in binary_writer.hpp.

Public API

No breaking changes. Serialization output is unchanged. Values nested deeper than the recursion limit no longer crash.

CI on this PR is expected to fail until #5779 fixes develop.

Closes #5392
Closes #5518

---

🤖 Generated with Claude Code