Limit Dockerfile JSON form parse depth

[Widthdom]

Summary

• Add extractor-local JsonDocumentOptions with a fixed depth limit for Dockerfile JSON-form parsing.
• Apply the bounded parser options to Dockerfile VOLUME, SHELL, COPY, and ADD JSON forms.
• Add focused Dockerfile extraction coverage for too-deep JSON-form payloads.

Validation

• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~SymbolExtractorTests.Extract_Dockerfile"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet build
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-build
• Codex adversarial review: No blocking/actionable issues found.

Documentation and changelog

• Changelog fragment: changelog.d/unreleased/3034.security.md
• No README or guide changes were needed; this only bounds existing Dockerfile extraction internals without changing CLI flags or output contracts.

Issues

Fixes #3034

Follow-up candidates

• None.