Fix Any recursion depth bypass in Python json_format.ParseDict

[aviralgarg05]

This fixes a security vulnerability where nested google.protobuf.Any messages could bypass the max_recursion_depth limit, potentially leading to denial of service via stack overflow.

The root cause was that _ConvertAnyMessage() was calling itself recursively via methodcaller() for nested well-known types, bypassing the recursion depth tracking in ConvertMessage().

The fix routes well-known type parsing through ConvertMessage() to ensure proper recursion depth accounting for all message types including nested Any.

Fixes #25070

[ankitsinha-cmyk]

Consider:

1. Add a comment clarifying how you count depth and whether max_recursion_depth is inclusive/exclusive.

2. Adding a test that explicitly asserts that depth==max_recursion_depth-1 succeeds and depth==max_recursion_depth fails, so the boundary behavior is documented.

[benglewis]

I understand this this is failing CI/CD and all... but we are stuck with our packages failing on vulnerabilities with this fix. What is the ETA for getting this merged?

[ankitsinha-cmyk]

@aviralgarg05 thanks for incorporating the changes. Looks fine to me now.

[crmpicco]

Thanks @paulhodson , that is a useful tip for future