stackitem: limit buffer/bytearray reads upon deserialization

This is not the way it's done in C#, but that's the most sensible approach to
me.

pkg/vm/stackitem/serialization.go

@@ -98,7 +98,7 @@ func DecodeBinaryStackItem(r *io.BinReader) Item {
 
 	switch t {
 	case ByteArrayT, BufferT:
-		data := r.ReadVarBytes()
+		data := r.ReadVarBytes(MaxSize)
 		return NewByteArray(data)
 	case BooleanT:
 		var b = r.ReadBool()