[Security] No built-in query depth/complexity limit + alias bombing DoS

## Summary
Two related DoS vectors in the execution engine:

### 1. No query depth or complexity limit
Recursive types + deep queries cause exponential resolver amplification. No built-in depth limit exists at execution time (only MaxIntrospectionDepthRule at validation).

### 2. Alias bombing
Thousands of aliases for the same field in a single flat query bypass all depth-based defenses, multiplying resolver cost linearly.

## Suggested Fix
Add optional `maxDepth` and `maxAliases` parameters to the execution options, similar to `MaxIntrospectionDepthRule`.