Sync two upstream decoder limit fixes into the vendored azure-uamqp-c

## Summary

The vendored copy of azure-uamqp-c does not carry two decoder fixes that upstream merged on 2026-05-19. Both fixes bound the resources that the AMQP value decoder gives to one input. Cherry-pick both into `sdk/core/azure-core-amqp/src/impl/uamqp/vendor/azure-uamqp-c`.

## Motivation

The AMQP value decoder reads data from the network, so a bound on its resource use protects every caller of the uAMQP transport.

Upstream [#479](https://github.com/Azure/azure-uamqp-c/pull/479) extends the existing 100 MB allocation guard to the `vbin32`, `str32`, and `sym32` decode paths. The vendored `src/amqpvalue.c` defines `MAX_AMQPVALUE_MALLOC_SIZE_BYTES` at line 17 and reads it only at line 6456, which is the `list32` path.

Upstream [#478](https://github.com/Azure/azure-uamqp-c/pull/478) caps decoder nesting at 128 levels, so a deeply nested described value, list, map, or array cannot drive unbounded recursion. The vendored copy defines no `MAX_DECODER_DEPTH`.

The C++ SDK ships the uAMQP transport today. A move to the Rust transport does not remove this code from a consumer that still selects uAMQP.

## Proposal

- Cherry-pick upstream #479 into the vendored `src/amqpvalue.c`, with the three unit tests that it adds.
- Cherry-pick upstream #478 into the vendored decoder, with the unit tests that it adds.
- Keep the rest of upstream master out of this change. Upstream also migrated its dependencies and reworked its CI, and neither one touches this repository.
- Upstream `version.txt` reads 1.2.12, which matches the vendored copy, so no tagged release carries these fixes. A maintainer must decide whether this repository takes a cherry-pick from upstream master.

## Validation

PR #7324 built the vendored library on every `cpp - core - ci` matrix leg with `DISABLE_RUST_IN_BUILD` on. That run reported no compiler warning and no error for the vendored tree, so it is the baseline for this change.