fix: add maximum nesting depth to CBOR decoder

[jterapin]

Summary

• Adds a depth counter to decode_item that raises ParseError when
  nesting exceeds 128 levels
• Without this, a crafted payload of nested CBOR containers causes unbounded recursion, raising SystemStackError which escapes our rescue StandardError handler and crashes the process
• ParseError inherits from StandardError, so it is caught cleanly

Context

Taken care of as part of oncall. Value of 128 chosen to match other Smithy-based SDKs (e.g. smithy-rs max_depth). No AWS service currently uses rpcv2Cbor, so practical exposure is zero today so this is a proactive fix before any service adopts it.