[CVE-2022-2795] [v9_11] Bound the amount of work performed for delegations
The CHANGES entry is added because it's easy to do, but the release note isn't, as it requires adding a new doc/arm/notes-9.11.38.xml file, which would suggest a new release, which won't happen.
Order of battle:
-
1. this MR -
2. !7241 (merged) -
3. !7242 (merged)
Closes #3394 (closed)