fix: bound AMF3 decoding and stop hashing client keys

Client-sent AMF (CONTROL_BEHAVIORS) was decoded without limits on the
associative part of arrays, on nesting depth, or on the total number of
values. Associative entries went into an unordered_map with the standard
unseeded string hash, so a client could pick colliding keys and make
insertion quadratic, and deeply nested arrays recursed until the stack
overflowed, crashing the world server.

- The associative map is now an ordered std::map (O(log n) whatever the
  keys, deterministic serialization order).
- Each array allows at most 10,000 associative entries, the same as the
  existing dense limit, which is now checked before anything is read.
- Arrays may nest at most 32 deep and one deserializer reads at most
  100,000 values. Every limit throws, which the only caller already
  catches and drops the message.
- Inserting a duplicate key keeps the last value and no longer returns a
  reference to a value that was destroyed when the key already held null.

Verified with new unit tests for each limit (including a 100,000 deep
nesting that previously overflowed the stack) and the existing live
packet test, which still decodes.

Fixes #2035

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dCommon/AMFDeserialize.h

@@ -9,6 +9,15 @@
 
 class AMFDeserialize {
 public:
+	// Most entries one array may hold, in each of its dense and associative parts.
+	static constexpr uint32_t MaxArraySize = 10'000;
+
+	// Deepest nesting of arrays allowed. Client UI messages nest a handful of levels.
+	static constexpr uint32_t MaxDepth = 32;
+
+	// Most values one deserializer will read over its lifetime.
+	static constexpr uint32_t MaxValues = 100'000;
+
 	/**
 	 * Read an AMF3 value from a bitstream.
 	 *
@@ -69,4 +78,10 @@ private:
 	 * List of strings read so far saved to be read by reference.
 	 */
 	std::vector<std::string> accessedElements;
+
+	// How deeply nested the array being read is.
+	uint32_t m_Depth = 0;
+
+	// How many values have been read so far.
+	uint32_t m_ValuesRead = 0;
 };