Fix exponential expansion based DoS in merge key processing

Resolves #897
Supercedes #916

### Summary
The merge key (`<<`) constructor implementation in
`SafeConstructor.flatten_mapping()` was vulnerable to an
exponential time and memory complexity Denial of Service (DoS)
vulnerability. When mapping/sequence nodes are merged using
anchors/aliases, duplicate references to the same alias point
to the same MappingNode instance in Python. During merge key
processing, the node values are copied and extended in-place.
If the same node appears multiple times at different levels,
this causes exponential amplification of the elements list:
`2^(n+1) - 1`.

A small document under 1 KB can trigger millions of element
list extensions, exhausting CPU and memory during safe loading.

### Hardened Fix
This commit resolves the vulnerability and hardens it against
secondary vectors:
1. Tracks node identity using object ID (`id(node)`) in a single
`seen` set scoped to the parent mapping's `flatten_mapping()`
execution.
2. Checks and skips duplicate node references inside SequenceNode
merge keys (resolving PR-916).
3. Checks and skips duplicate node references across separate,
independent MappingNode merge keys in the same mapping (e.g.,
repeating `<<: *anchor` multiple times).
4. Ensures C-based loaders (e.g., `CSafeLoader`, `CLoader`) are
also protected since they inherit constructor logic from
`SafeConstructor`.

### Performance Impact
- Sequence-nested merge duplicates: Loading a 22-level nested
document drops from 3.76s to 0.0028s (O(N) linear complexity).
- Mapping-level merge duplicates: Loading a 20-level nested
document drops from 0.93s to 0.0026s.

### Tests
- Added regression tests to
`tests/legacy_tests/data/construct-merge.data` and
`tests/legacy_tests/data/construct-merge.code` covering both
duplicate sequence merges and duplicate direct merges.

Author: aaronbronow

lib/yaml/constructor.py

@@ -180,16 +180,19 @@ def construct_scalar(self, node):
     def flatten_mapping(self, node):
         merge = []
         index = 0
+        seen = set()
         while index < len(node.value):
             key_node, value_node = node.value[index]
             if key_node.tag == 'tag:yaml.org,2002:merge':
                 del node.value[index]
                 if isinstance(value_node, MappingNode):
+                    if id(value_node) in seen:
+                        continue
+                    seen.add(id(value_node))
                     self.flatten_mapping(value_node)
                     merge.extend(value_node.value)
                 elif isinstance(value_node, SequenceNode):
                     submerge = []
-                    seen = set()
                     for subnode in value_node.value:
                         if not isinstance(subnode, MappingNode):
                             raise ConstructorError("while constructing a mapping",

tests/legacy_tests/data/construct-merge.code

@@ -7,4 +7,6 @@
     { "x": 1, "y": 2, "r": 10, "label": "center/big" },
     { "x": 1, "y": 2, "r": 10, "label": "center/big" },
     { "x": 1, "y": 2, "r": 10, "label": "center/big" },
+    { "x": 1, "y": 2, "r": 10, "label": "center/big" },
+    { "x": 1, "y": 2, "r": 10, "label": "center/big" },
 ]

tests/legacy_tests/data/construct-merge.data

@@ -25,3 +25,14 @@
   << : [ *BIG, *LEFT, *SMALL ]
   x: 1
   label: center/big
+
+- # Duplicate sequence merge
+  << : [ *CENTER, *CENTER ]
+  r: 10
+  label: center/big
+
+- # Duplicate direct merge
+  << : *CENTER
+  << : *CENTER
+  r: 10
+  label: center/big