feat: Add nested comprehension depth limits (fixes #35)

Implements protection against resource exhaustion from deeply nested
CEL comprehensions by enforcing a maximum nesting depth of 3 levels.

**Changes:**
- Added maxComprehensionDepth constant (value: 3)
- Added comprehensionDepth field to converter struct to track nesting
- Implemented depth checking in visitComprehension() with automatic
  increment/decrement using defer
- Modified wrapConversionError() to preserve specific error messages
  through the wrapping chain
- Added comprehensive test suite with 6 test functions covering all
  boundary conditions and edge cases

**Security Impact:**
- Prevents DoS attacks through expensive nested UNNEST/subquery operations
- Addresses CWE-400: Uncontrolled Resource Consumption
- Users attempting to exceed depth limit receive clear error messages

**Examples:**
- Depth 1-3: ✓ Allowed (e.g., list1.map(x, list2.filter(y, list3.exists(z, z > y))))
- Depth 4+: ✗ Rejected with error "comprehension nesting depth N exceeds maximum of 3"

All existing tests continue to pass. Backward compatible for expressions
within the depth limit.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: richardwooding

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [Unreleased]
+
+### Security
+- **Nested Comprehension Depth Limits**: Added protection against resource exhaustion from deeply nested comprehensions (fixes #35)
+  - Implemented maximum nesting depth of 3 for CEL comprehensions (all, exists, exists_one, filter, map)
+  - Prevents DoS attacks through expensive nested UNNEST/subquery operations (CWE-400)
+  - Clear error messages guide users to restructure overly complex queries
+  - Example protected pattern: `list1.map(x, list2.filter(y, list3.exists(z, z > y)))` now limited to depth 3
+
 ## [2.10.0] - 2025-10-10
 
 ### Added

cel2sql.go

@@ -39,6 +39,10 @@ const (
 	// defaultMaxRecursionDepth is the default maximum recursion depth for visit()
 	// to prevent stack overflow from deeply nested expressions (CWE-674: Uncontrolled Recursion).
 	defaultMaxRecursionDepth = 100
+
+	// maxComprehensionDepth is the maximum nesting depth for CEL comprehensions
+	// to prevent resource exhaustion from deeply nested UNNEST/subquery operations (CWE-400).
+	maxComprehensionDepth = 3
 )
 
 // ConvertOption is a functional option for configuring the Convert function.
@@ -267,16 +271,17 @@ func ConvertParameterized(ast *cel.Ast, opts ...ConvertOption) (*Result, error)
 }
 
 type converter struct {
-	str          strings.Builder
-	typeMap      map[int64]*exprpb.Type
-	schemas      map[string]pg.Schema
-	ctx          context.Context
-	logger       *slog.Logger
-	depth        int           // Current recursion depth
-	maxDepth     int           // Maximum allowed recursion depth
-	parameterize bool          // Enable parameterized output
-	parameters   []interface{} // Collected parameters for parameterized queries
-	paramCount   int           // Parameter counter for placeholders ($1, $2, etc.)
+	str                 strings.Builder
+	typeMap             map[int64]*exprpb.Type
+	schemas             map[string]pg.Schema
+	ctx                 context.Context
+	logger              *slog.Logger
+	depth               int           // Current recursion depth
+	maxDepth            int           // Maximum allowed recursion depth
+	comprehensionDepth  int           // Current comprehension nesting depth
+	parameterize        bool          // Enable parameterized output
+	parameters          []interface{} // Collected parameters for parameterized queries
+	paramCount          int           // Parameter counter for placeholders ($1, $2, etc.)
 }
 
 // checkContext checks if the context has been cancelled or expired.
@@ -1016,6 +1021,16 @@ func (con *converter) visitCallUnary(expr *exprpb.Expr) error {
 }
 
 func (con *converter) visitComprehension(expr *exprpb.Expr) error {
+	// Track comprehension nesting depth to prevent resource exhaustion (CWE-400)
+	con.comprehensionDepth++
+	defer func() { con.comprehensionDepth-- }()
+
+	// Check comprehension depth limit before context check (fail fast)
+	if con.comprehensionDepth > maxComprehensionDepth {
+		return fmt.Errorf("comprehension nesting depth %d exceeds maximum of %d",
+			con.comprehensionDepth, maxComprehensionDepth)
+	}
+
 	// Check for context cancellation before processing comprehensions (potentially expensive)
 	if err := con.checkContext(); err != nil {
 		return err