fix(identity): bound nesting depth and fan-out when deserializing composite identities

fix(identity): bound nesting depth and fan-out when deserializing composite identities #9497