Add compression bomb test

[masih]

Can we add a compression bomb test? I think we're fine, but it would be nice to have a test.

• The fact that we're stream decoding into the CBOR decoder coupled with the fact that the CBOR decoder has a bunch of limits should protect us against memory issues.
• The fact that our CBOR decoder won't read through unlimited input (e.g., doesn't have logic that skips unknown fields, etc.) means we can't get "stuck" when decoding. But it would be nice if we could wrap the decompressed reader in a limited reader before passing it off to the CBOR decoder, just in case. That way we can guarantee that we'll process at most N bytes of CBOR before giving up.

Originally posted by @Stebalien in #842 (comment)

[masih]

Added strict limits to zstd decoded values here: 05bc578 anlong with tests.