Enforce Starlark nested set depth limit in runfiles.merge() and merge_all()

We want to prevent overly deep nested sets which can cause a stack overflow.

Since we are now accessing --nested_set_depth_limit from additional places
(Runfiles as well as Depset), we want to move the option from
NestedSetOptionsModule to BuildLanguageOptions (where, arguably, it ought to
have been from the start). As a nice side effect, since the depth limit no
longer lives in global static state, depth limit tests are now thread-safe
regardless of sharding.

RELNOTES: runfiles.merge() and merge_all() now respect --nested_set_depth_limit.
If you hit the depth limit because you were calling merge() in a loop, use
merge_all() on a sequence of runfiles objects instead.
PiperOrigin-RevId: 364631293