Add StreamReadConstraints.maxNestingDepth() to constraint max nesting depth (default: 1000)

[pjfanning]

Basically #926 but depth is tracked on the JsonStreamContext instead. I have built a jackson-databind enhancement based on this.

[cowtowncoder]

Yes; this is along lines of what I was originally thinking. I think there are some benefits in avoiding possibility of accidentally forgotten "closing" of nesting levels, to avoid bugs,

[cowtowncoder]

Not related to this PR specifically, but one thing we may want to do afterwards is to add something to note that StreamReadConstraints settings control this -- just add some more verbiage in exception message.
But I think that makes sense as a separate PR once we have nesting depth checks covered.

[pjfanning]

StreamConstraintsException has Javadoc that describes what the exception is about. I'm not sure there is much to be gained by making the message more verbose.

[cowtowncoder]

My perspective is that when someone sees a stack trace in log files, it is nice to have slightly more information on context to give Ops people bit more clue on what might be happening.

But I guess minimum level certainly is to have information on exception class itself, pointing to constraints settings. I'll see if I can add something to relevant JAva class(es) in jackson-core.

[cowtowncoder]

@pjfanning Let me know if and when you are content with the base -- I think this is the last "must-have" feature before 2.15 release candidates.

[pjfanning]

@pjfanning Let me know if and when you are content with the base -- I think this is the last "must-have" feature before 2.15 release candidates.

@cowtowncoder I'm happy to get this merged more or less as it is. There is uptake needed in numerous other Jackson modules so it would be good to make a start on that.

[cowtowncoder]

@pjfanning Merged into 2.15, up to master -- will make some smaller changes (increase test coverage, add that one constructor).

Note: master will require quite a bit more work other formats as array/object context creation has moved from ParserBase (used by non-JSON backends) into JsonParserBase -- this to support custom context subtypes better.