Cap string-producing chb chains in core builtins

Cap string-producing chb chains in core builtins

Overflow now trips during chain growth and surfaces as a catchable
RangeError("invalid string length") instead of continuing to inflate
the VM memory pool until the process OOMs.

Out of scope (non-JS-string chains):
  - njs_vm.c AST serialization
  - njs_json.c njs_vm_value_dump (console.log value dump)
  - njs_function.c new Function() source assembly
  - njs_error.c error message composition
  - external/ modules on both engines (querystring, xml, zlib)

This fixes OOM in staging/sm/String/replace-math Tests262.