Instruction limits aren't enforced throughout cross program invocations

[hendrikhofstadt]

Problem

When a program invokes another BPF program via CPI, the instruction counter is not carried over. Since Solana currently allows 5 layers of call depth, this allows for instructions that take extremely long to compute and can overwhelm message processing and take the network down.

Proposed Solution

Enforce instruction limits on CPI calls to other BPF programs. Potentially also limit the number of CPIs to non-BPF programs (to prevent spam of system instructions).

[jackcmay]

Limits are enforced, its just that they are very high and additive when doing cross-program invocations :-)

As @aeyakovenko suggested switching to a max of ~25ms total for each top-level instruction is probably reasonable.

[mvines]

Consider limiting the depth of the CPI stack as well, perhaps to 1 for now