Handle circular fragment references

[ivome]

Summary

Detect and skip circular fragment spreads during complexity analysis to prevent infinite recursion when evaluating invalid queries.

nodeComplexity() now tracks fragment names on the active spread path via a backtracking Set. When a fragment spread references a fragment already on that path, the spread is skipped instead of recursing indefinitely. This is a defense-in-depth measure alongside GraphQL's NoFragmentCyclesRule — graphql-js runs validation rules in parallel without early abort, so the complexity visitor could still recurse into a cycle before the cycle error is reported.

For acyclic queries, behavior is unchanged: the set is only populated during fragment descent and cleared on the way back up, so sibling spreads and diamond patterns still count correctly. The backtracking approach keeps traversal O(n) in time and memory (no per-descent Set copies).