Limit recursive object merge depth to prevent stack overflow

This fixes CVE-2026-43896.

tests/jq.test

@@ -2602,3 +2602,12 @@ true
 try (reduce range(10001) as $_ ([]; [.]) as $x | $x | contains($x)) catch .
 null
 "Containment check too deep"
+
+# regression test for CVE-2026-43896
+reduce range(10000) as $_ ({}; {a: .}) as $x | $x * $x | length
+null
+1
+
+try (reduce range(10001) as $_ ({}; {a: .}) as $x | $x * $x) catch .
+null
+"Object merge too deep"