Detect circular module imports to prevent stack overflow

jq used to recurse without bound on mutual or self-referential
`import` declarations, exhausting the stack. Track each library's
load state with a `loading` flag set before its dependencies are
processed; a recursive reference to an in-progress library now
reports "circular import of X".

Fixes CVE-2026-44777.

tests/modules/cycle_a.jq

@@ -0,0 +1,2 @@
+import "cycle_b" as b;
+def f: null;

tests/modules/cycle_b.jq

@@ -0,0 +1,2 @@
+import "cycle_a" as a;
+def f: null;

tests/modules/cycle_self.jq

@@ -0,0 +1,2 @@
+import "cycle_self" as s;
+def f: null;