Interface DecodeLimits

Opt-in decode resource limits (corelib-ts#38).

SofaBuffers' count (arrays) and maxlen (strings / blobs) schema bounds are optional; when a schema omits them the decoder accepts whatever count / length the received message claims, with no upper bound. That leaves a receiver no way to cap memory against a hostile, oversized field. DecodeLimits is that cap: an optional options object accepted by every decode entry point (decode, the IStream constructor, and the Cursor constructor).

The limits are a receiver-side policy, not part of the wire format or the message schema. The normative source of the values is the sofabgen config (see sofa-buffers/generator#102): the generator bakes them into generated code as constants and passes them here at decoder construction. This corelib only provides the mechanism — an omitted limit means no cap (today's behavior); there is no corelib-side default.

Enforcement happens at header time — where the count / length is first decoded, before any array is sized or any payload is accepted or streamed — so a claimed oversize is rejected even if the payload never arrives. Exceeding a limit is never clamped or truncated: it throws a SofabError with code SofabErrorCode.LimitExceeded, which is deliberately distinct from InvalidMsg (policy, not malformation).