…ny nesting limit (#26835)

## Summary

`JsonParser.MergeAny()` records the JSON token stream of an Any body and replays it through a fresh `JsonReplayTokenizer` to parse the inner message. The replay tokenizer's `RecursionDepth` was never initialized from the parent tokenizer, so it defaulted to zero — and the recursion-depth check in `JsonParser.Merge()` reads the **tokenizer's** depth field. As a result, every nested `google.protobuf.Any` started at depth zero and the `Settings.RecursionLimit` check never fired.

A pathological JSON document such as

```json
{"@type":"type.googleapis.com/google.protobuf.Any","value":
 {"@type":"type.googleapis.com/google.protobuf.Any","value":
  {"@type":"type.googleapis.com/google.protobuf.Any","value": ... }}}
```

recurses through `MergeAny -> MergeWellKnownTypeAnyBody -> Merge -> MergeAny -> ...` until the .NET stack is exhausted, raising an uncatchable `StackOverflowException` and terminating the host process.

The pre-existing `// FIXME: Object depth not maintained...` comment in `JsonReplayTokenizer` already acknowledged the gap.

## Prior art

The same bug class has previously been fixed in the sibling language implementations of protobuf:

- **Java** — `mergeAnyMessage` was missing the `currentDepth` increment.
- **Python** — `_ConvertAnyMessage` reached via `methodcaller(...)` bypassed the depth tracking.

The C# `MergeAny` path was overlooked at the time. A C# *array* recursion fix landed previously, but the Any case was not covered.

## Fix

Inherit the parent tokenizer's `RecursionDepth` when constructing a `JsonReplayTokenizer`, so that `JsonParser.Merge()`'s existing limit check applies across the replay boundary.

```csharp
internal JsonReplayTokenizer(IList<JsonToken> tokens, JsonTokenizer nextTokenizer)
{
    this.tokens = tokens;
    this.nextTokenizer = nextTokenizer;
    this.RecursionDepth = nextTokenizer.RecursionDepth;
}
```

## Tests

Added `JsonParserTest.MaliciousRecursionOfAnyInAny`, mirroring the existing `MaliciousRecursionOfObjectsInValue` / `MaliciousRecursionOfArraysInValue` regression tests:

- Builds a 100-deep Any-of-Any document.
- A parser with a generous limit parses it without exception.
- A parser with an insufficient limit throws `InvalidProtocolBufferException` (rather than overflowing the stack).

Without the fix, the second assertion either spins past the configured limit (because each replay tokenizer resets depth to zero) or terminates the test runner with `StackOverflowException`.

Closes #26835

COPYBARA_INTEGRATE_REVIEW=#26835 from MindflareX:fix/csharp-any-recursion-depth 8d5f579
FUTURE_COPYBARA_INTEGRATE_REVIEW=#26835 from MindflareX:fix/csharp-any-recursion-depth 8d5f579
PiperOrigin-RevId: 903860227