expr: deeply nested parentheses cause a stack overflow (recursive parser) #13146

Reported by @HackingRepo via security advisory GHSA-gr9g-xjfw-pqfw. We don't consider this a security issue, so we're tracking it as a regular bug.

Description
expr uses a recursive-descent parser with no depth limit, so a deeply nested expression aborts the process with a stack overflow instead of evaluating or erroring cleanly.

Repro

$ expr $(python3 -c "print('('*5000)") 1 $(python3 -c "print(')'*5000)")
thread 'main' has overflowed its stack
fatal runtime error: stack overflow, aborting   # SIGABRT

GNU evaluates the same input and exits 0.

Expected: bounded recursion (or iterative parsing) returning a normal result/error.
Actual: stack overflow → abort. A crash on untrusted input.