Add binary deserialization depth limit and swap to Syntax

This change adds the standard protobuf deserialization depth limit of 200.

Today, overruns trigger RangeErrors from the VM. We are now catching
these and swapping them to SyntaxError.

Author: dibenede

.github/workflows/build.yml

@@ -8,7 +8,7 @@ permissions:
 
 # update in build.yml and codeql.yml at same time
 env:
-  PROTOC_VERSION: "35.1"
+  PROTOC_VERSION: "36.1"
 
 jobs:
   build:

MODULE.bazel

@@ -1,6 +1,6 @@
 "Bazel module that provides protoc-gen-js."
 
-module(name = "protobuf_javascript", version = "4.0.2")  # updated by release action
+module(name = "protobuf_javascript", version = "4.0.3")  # updated by release action
 
 bazel_dep(name = "abseil-cpp", version = "20250814.1")
 bazel_dep(name = "protobuf", version = "33.4", repo_name = "com_google_protobuf")

MODULE.bazel.lock

@@ -108,15 +108,26 @@ function negativeByteLengthError(
   return new Error(`Tried to read a negative byte length: ${length}`);
 }
 
+/**
+ * Reports that the maximum recursion depth was exceeded.
+ *
+ * @return {!SyntaxError}
+ */
+function maxRecursionDepthExceededError() {
+  return new SyntaxError('Maximum protobuf recursion depth exceeded');
+}
+
 exports = {
   messageLengthMismatchError,
   groupDidNotEndWithEndGroupError,
   invalidFieldNumberError,
   invalidVarintError,
   invalidWireTypeError,
   malformedBinaryBytesForMessageSet,
+  maxRecursionDepthExceededError,
   negativeByteLengthError,
   readTooFarError,
   unmatchedStartGroupError,
   unmatchedStartGroupEofError,
 };
+