fix: bound YAML anchor/alias expansion to prevent OOM (billion laughs)

fix: bound YAML anchor/alias expansion to prevent OOM (billion laughs) #1290