Set max depth for JSON serializer to mitigate known DOS vulnerability (…

…#902)

The other option is to update Newtonsoft.Json, which now also sets the
maximum depth by default, but this mitigates without having to update.

src/JsonRpc/Serialization/SerializerBase.cs

@@ -19,7 +19,7 @@ protected virtual JsonSerializer CreateSerializer()
 
         protected virtual JsonSerializerSettings CreateSerializerSettings()
         {
-            var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings();
+            var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings { MaxDepth = 128 };
             AddOrReplaceConverters(settings.Converters);
             return _settings = settings;
         }