fix: enforce max_array_size during JSON array decode

[cursor]

Summary

max_array_size (100M elements) was declared as a DoS limit but never checked during JSON array parsing, so arrays could grow without bound.

Bug and impact

• Trigger: Parse a JSON array (top-level, nested, or under an object) with more than max_array_size elements.
• Impact: Unbounded memory growth / DoS; the documented limit was not enforced.

Root cause

The constant existed next to the enforced max_string_length / max_nesting_depth caps, but array element acceptance paths (array_first / array_next) never counted or rejected oversized arrays.

Fix

• Track a per-nested-array element count on [ / ].
• Reject when a new element would exceed the limit (before the value is built).
• Allow a custom limit on decoder for fast regressions.

Validation

• Added ArraySizeLimitEnforced covering exact limit, overflow, nested arrays, arrays under objects, and empty/short arrays.
• ./tools/CB.sh debug test --tags='\[xson\]' — 422/422 passed.