Guard against DoS in name constraints handling.