fix(decode): cap alloc limits and fix flag check for OOM safety

[xe-nvdk]

Summary

• Cap decodeSlice() allocation at sliceAllocLimit (1M) to prevent OOM from malicious payloads claiming huge array lengths
• Cap DecodeMap() allocation at maxMapSize (1M) — same OOM vector for the map[string]interface{} path used by Arc's *interface{} fast path
• Fix disableAllocLimitFlag check in decodeSliceValue — != 1 was always true because the flag value is 1 << 3 = 8, so growSliceValue() alloc limit was never applied
• Fix error message in DecodeFloat64 — said "decoding float32" instead of "decoding float64"
• Add v6 changelog

Closes #1, closes #13.

Test plan

• go test ./... -v -count=1 — all tests pass (except pre-existing upstream TestTypes panic, issue Decode panics on nil interface with pre-populated typed pointer (upstream #304) #21)
• go test -run='^$' -bench=. -benchmem -count=3 — zero performance regression