A follow up from #5239 to improve how WitnessDecoder::resize_if_needed caps its memory allocation. Original comments from @apoelstra:

I also think that somewhere we should be capping required_len to 20 Mb, which I think is the maximum amount it can be for a valid witness (one with 4 million entries, 3999999 of which are 0-length and the other one 4 million bytes).

and

This can overflow on a 16-bit machine. We should clamp new_len to usize::MAX

This may be influenced by what direction @jrakibi takes in #5177.