merge aliases bypass positive maxAliasCount limits

[vekexasia]

Describe the bug

maxAliasCount appears to apply to normal aliases, but not to aliases used through YAML merge keys when merge: true is enabled.

This looks related to #677, but the repro below does not require a cyclic merge. It is just repeated merge aliases with a positive maxAliasCount.

To Reproduce

import YAML from 'yaml'

const mergeSrc =
  'base: &B { x: 1 }\n' +
  Array.from({ length: 500 }, (_, i) => `m${i}: { <<: *B }`).join('\n')

const plainSrc =
  'base: &B { x: 1 }\n' +
  Array.from({ length: 101 }, (_, i) => `m${i}: *B`).join('\n')

YAML.parse(mergeSrc, { merge: true, maxAliasCount: 1 })
console.log('merge aliases allowed')

YAML.parse(plainSrc, { maxAliasCount: 100 })
// throws ReferenceError: Excessive alias count indicates a resource exhaustion attack

Expected behavior

The merge-alias case should be limited by maxAliasCount, or the docs should clarify that merge aliases are intentionally excluded from positive maxAliasCount checks.

Actual behavior

The merge-alias case succeeds with maxAliasCount: 1, while the normal alias case is blocked.

maxAliasCount: 0 does still block merge aliases, so this looks inconsistent: zero disables aliases, but positive limits are not counted for merge aliases.

Notes

From a quick look, merge handling appears to resolve aliases through Alias.resolve() directly, while the positive alias counting happens in Alias.toJS().

Tested with yaml@2.9.0 and current main checkout.

[eemeli]

This seems to just restate conversation already in #685?