fix(state): treat non-object and oversized-integer JSON as malformed state

[allen0099]

Fixes #368.

StateManager._decode_state let two kinds of malformed stored state escape as the wrong exception:

• JSON that is not an object ([1, 2], "x", 1, null): StateData(**...) raised TypeError, and only ValueError was caught.
• An integer longer than sys.int_info.default_max_str_digits (4300 by default), top-level or nested: json.loads raised a plain ValueError, and only JSONDecodeError was caught.

Both now raise StateDataError, so the three public methods behave as documented for malformed data: validate_state() returns False, get_state_metadata() returns None, and consume_state() raises StateDataError (the entry is deleted, as before).

The non-object case is checked with isinstance(..., dict) after json.loads rather than by also catching TypeError, so the error names the problem and an unrelated TypeError from the model is not swallowed. The oversized-integer case came up while reviewing this fix.

Tests

• Parametrized tests for each of the three methods with the four non-object values, and one covering the oversized integer (top-level and nested). Without the fix, all of them fail.
• The full suite passes with the Redis and Memcached tests enabled.
• Changelog fragment: changelog.d/368.fixed.md.