Fix stack overflow from circular alias in traverse

[jandubois]

go-yaml accepts cross-document alias references, which the YAML spec forbids (anchors are scoped to a single document). When a nested assignment targets such an alias, UpdateFrom copies the Alias field between nodes, creating a self-referencing AliasNode. Both traverse() and traverseArrayIndices() then follow this cycle indefinitely.

Extract resolveAliasChain(), which follows aliases iteratively with a visited set and returns an error on cycles. Both traverse() and traverseArrayIndices() now call it, eliminating the recursive alias handling in both code paths.

Note: traverseMergeAnchor() also dereferences aliases (lines 358 and 371) but with single-step assignment, not recursion. A self-referencing alias there falls through the kind switch silently rather than crashing. Using resolveAliasChain() in that function would produce a clear error instead of silently dropping the node.

Reproducer (stack overflow before this fix, returns error after):

echo '&-- a
---
*--' | yq eval-all '. = (.x = 1)'

Found by OSS-Fuzz via the lima project's FuzzEvaluateExpression target. https://issues.oss-fuzz.com/issues/390467412

[ccoVeille]

go-yaml accepts cross-document alias references, which the YAML spec forbids (anchors are scoped to a single document).

Hey @ingydotnet

What are your thoughts on this statement?

We should detect at go-yaml level if it's relevant