fix: bound AMF3 decoding and stop hashing client keys

Client-sent AMF (CONTROL_BEHAVIORS) was decoded without limits on the
associative part of arrays, on nesting depth, or on the total number of
values. Associative entries went into an unordered_map with the standard
unseeded string hash, so a client could pick colliding keys and make
insertion quadratic, and deeply nested arrays recursed until the stack
overflowed, crashing the world server.

- The associative map is now an ordered std::map (O(log n) whatever the
  keys, deterministic serialization order).
- Each array allows at most 10,000 associative entries, the same as the
  existing dense limit, which is now checked before anything is read.
- Arrays may nest at most 32 deep and one deserializer reads at most
  100,000 values. Every limit throws, which the only caller already
  catches and drops the message.
- Inserting a duplicate key keeps the last value and no longer returns a
  reference to a value that was destroyed when the key already held null.

Verified with new unit tests for each limit (including a 100,000 deep
nesting that previously overflowed the stack) and the existing live
packet test, which still decodes.

Fixes #2035

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dCommon/Amf3.h

@@ -5,7 +5,7 @@
 #include "Logger.h"
 #include "Game.h"
 #include <type_traits>
-#include <unordered_map>
+#include <map>
 #include <vector>
 
 enum class eAmf : uint8_t {
@@ -115,8 +115,9 @@ using AMFDoubleValue = AMFValue<double>;
  * and are not to be deleted by a caller.
  */
 class AMFArrayValue : public AMFBaseValue {
-	using AMFAssociative =
-		std::unordered_map<std::string, std::unique_ptr<AMFBaseValue>, GeneralUtils::transparent_string_hash, std::equal_to<>>;
+	// An ordered map keeps lookups and inserts O(log n) no matter which keys a client sends.
+	// A hash map here let a client pick colliding keys and make decoding quadratic (HashDoS).
+	using AMFAssociative = std::map<std::string, std::unique_ptr<AMFBaseValue>, std::less<>>;
 
 	using AMFDense = std::vector<std::unique_ptr<AMFBaseValue>>;
 
@@ -222,9 +223,9 @@ public:
 	 */
 	template<typename AmfType>
 	AmfType& Insert(const std::string_view key, std::unique_ptr<AmfType> value) {
-		const auto element = m_Associative.find(key);
 		auto& toReturn = *value;
-		if (element != m_Associative.cend() && element->second) {
+		const auto element = m_Associative.find(key);
+		if (element != m_Associative.cend()) {
 			element->second = std::move(value);
 		} else {
 			m_Associative.emplace(key, std::move(value));