[Feature] Codec input hardening caps for JSON, CBOR and MessagePack

[pathosDev]

Use case

Frame-size caps bound how many bytes a peer can send, but not what those bytes decode into: deeply nested structures, giant strings and token floods are decoder-level DoS vectors that pass every frame check. Parse-level constraints are a separate, cheap guard for every codec we ship.

Proposed keys

actor-ts.serialization.read-constraints {
  max-nesting-depth = 1000
  max-string-length = 20M
  max-number-length = 1000
  max-name-length = 50000
  max-document-bytes = off       # off = frame cap governs
  max-token-count = off
}

Acceptance

• A payload exceeding a cap is rejected before allocation-heavy decoding, for JSON, CBOR and MessagePack alike.
• Keys ship wired — tests/unit/config/NoDeadConfigKeys.test.ts rejects a key nothing reads.

Part of the reference.conf expansion batch — tracked in #887.