fix: use allocating deserializers when scratch space exceeded

Issue enarx#32 describes a class of errors where `deserialize_str` (and `deserialize_bytes`) have match
expressions that fall through to an error when the `Text` (`Bytes`) lengths are longer than can fit
in the scratch array.

This patch works around that limitation by delegating to the corresponding allocating methods
`deserialize_string` (`deserialize_byte_buf`) in case the scratch space is too small.

This should address the issue even for types whose `Deserialize` visitor does not implement
`visit_string`, since the default implementation of that method delegates back to `visit_str` once
the fully-deserialized `String` is in hand.

This addition raises a question to me about the stance of the `ciborium` crate on `no_std`/`alloc`
support. This workaround depends on being able to use `String` and `Vec`, which rules out
`no_std`. But these allocating deserializers already exist in the code and don't appear to be
guarded by `cfg` directives, so I don't believe this patch changes the level of support provided for
these environments.

Author: acfoltzer

ciborium/src/de/mod.rs

@@ -333,6 +333,12 @@ where
                     }
                 }
 
+                // Longer strings require alloaction; delegate to `deserialize_string`
+                item @ Header::Text(_) => {
+                    self.decoder.push(item);
+                    self.deserialize_string(visitor)
+                }
+
                 header => Err(header.expected("str")),
             };
         }
@@ -371,6 +377,12 @@ where
                     visitor.visit_bytes(&self.scratch[..len])
                 }
 
+                // Longer byte sequences require alloaction; delegate to `deserialize_byte_buf`
+                item @ Header::Bytes(_) => {
+                    self.decoder.push(item);
+                    self.deserialize_byte_buf(visitor)
+                }
+
                 Header::Array(len) => self.recurse(|me| {
                     let access = Access(me, len);
                     visitor.visit_seq(access)