fix(internal/common): limit lexer recursion depth

[pavelnikolov]

• Limit the maximum parsing recursion depth in the lexer
• Improve docs to recommend limiting the length of queries by untrusted clients
• Add query max length check during query validation as well to match Exec and Subscribe

[Copilot]

Copilot review overview

🟡 Changes recommended

Clarify in README.md and SECURITY.md that MaxQueryLength applies only to Schema.Exec.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Scope MaxQueryLength enforcement to Exec or document other entry points · New
• Enforce MaxQueryLength consistently across query entry points · New

What changed in this PR

This PR limits parser recursion depth to reduce stack-overflow risk and documents query-size protections.

Changes:

• Adds depth tracking for selections, literals, and list types.
• Adds boundary tests for parser nesting depth.
• Documents MaxQueryLength and query-length security guidance.
• Clarifies that MaxQueryLength is enforced only by Schema.Exec, not Validate or Subscribe.

File	Summary
SECURITY.md	Adds query-length security guidance; scope MaxQueryLength to Schema.Exec.
README.md	Documents MaxQueryLength; clarify its enforcement scope.
internal/​query/​query.go	Guards nested selection parsing.
internal/​query/​query_test.go	Adds parser-depth boundary tests.
internal/​common/​types.go	Guards nested list types.
internal/​common/​literals.go	Guards nested literals.
internal/​common/​lexer.go	Implements recursion-depth tracking and enforcement.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.