[Security] No built-in query depth/complexity limit + alias bombing DoS

Summary

Two related DoS vectors in the execution engine:

1. No query depth or complexity limit

Recursive types + deep queries cause exponential resolver amplification. No built-in depth limit exists at execution time (only MaxIntrospectionDepthRule at validation).

2. Alias bombing

Thousands of aliases for the same field in a single flat query bypass all depth-based defenses, multiplying resolver cost linearly.

Suggested Fix

Add optional maxDepth and maxAliases parameters to the execution options, similar to MaxIntrospectionDepthRule.