[CVE-2022-2795] [v9_11] Bound the amount of work performed for delegations

The CHANGES entry is added because it's easy to do, but the release note isn't, as it requires adding a new doc/arm/notes-9.11.38.xml file, which would suggest a new release, which won't happen.

Order of battle:

• 1. this MR
• 2. !7241 (merged)
• 3. !7242 (merged)

Closes #3394 (closed)