fix: bound archive recursion with a cycle guard and depth ceiling

a negative `MaxDepth` really was unbounded, and nothing noticed an archive nested inside a copy of itself. A zip quine at `-1` recursed until memory, disk or file descriptors ran out, running the full sub-pipeline at every level.

- the walk keeps a stack of the digests of the archives it's inside, and an archive identical to one of them is recorded as an unknown instead of being entered
- negative depth now stops at 16 levels (docs and CLI description updated)
- cancellation is checked between candidates, so a cancelled scan stops walking instead of finishing the archive tree

the three unknown-recording blocks in `processArchive` became a one-line helper to stay under `funlen`.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/cataloger/java/capabilities.yaml

@@ -8,7 +8,7 @@ configs: # AUTO-GENERATED - config structs and their fields
       - key: IncludeUnindexedArchives
         description: IncludeUnindexedArchives indicates whether to search within unindexed archive files (e.g., .tar*).
       - key: MaxDepth
-        description: 'MaxDepth is how many levels of nested archives to catalog: 0 disables it, negative is unbounded.'
+        description: 'MaxDepth is how many levels of nested archives to catalog: 0 disables it, negative goes as deep as 16 levels.'
       - key: MaxMemoryBytes
         description: MaxMemoryBytes bounds the archive content held in memory at once; content that does not fit is written to disk. Zero means DefaultArchiveMaxMemoryBytes, negative is unbounded.
       - key: MaxDiskBytes