fix(abi): prevent decode amplification from aliased tail pointers

[0xbigapple]

What does this PR do?

• TypeDecoder: count what a decode produces against what the response carries, and
  reject when either count is exceeded:

  • dynamic payload bytes → against the input's byte length
  • decoded values → against the input's word count

  A value owns a word when it is fixed-width, or when it is reached through a tail
  pointer, so an aliased tail is paid for again by every element naming it. Inline
  containers own nothing, and length/offset words are structure rather than values.

• DefaultFunctionReturnDecoder: open one count for the whole function result, so
  outputs decoded one at a time cannot each claim the same tail.

• Counts are per-thread and cleared on the way out, including when the decode throws.
  No existing method signature or visibility is changed.

Why are these changes required?

An array's element count and every element's tail pointer are read straight from the
response, and nothing required those tails to be distinct. The two existing guards were
per-element and each measured against the whole remaining input, so L elements could
all name one tail — or overlapping tails — and each passed its own check while
allocating independently. A few hundred words of input then decode into tens of
thousands of objects, and the shape scales with the response, so a single hostile
constantResult can exhaust the heap of any process embedding the SDK. Reachable
whenever an output is declared as an array of a dynamic element type — string[],
bytes[], uint256[][], or an array of dynamic structs.

This PR has been tested by:

• Unit Tests

Follow up

Extra details