While auditing the Bitcoin Core RPC code I found an issue in UniValue. `UniValue::read()` in UniValue 1.0.3 and 1.0.4 allows a segfault via high object depth JSON.

Live demo:

```
$ src/bitcoind -regtest -rpcuser=u -rpcpassword=p > /dev/null &
[1] 8625
$ curl -u u:p --request POST \
      --data $(python -c 'print(50000 * "[");') http://127.0.0.1:18443
curl: (52) Empty reply from server
[1]+  Segmentation fault      (core dumped) src/bitcoind -regtest -rpcuser=u -rpcpassword=p > /dev/null
```

I reported the issue to `security@` and UniValue author @jgarzik back in early November 2019. The issue was fixed in commit https://github.com/jgarzik/univalue/commit/fe2227d4ace9d4d5b30710684c9d3b1012e3c0fc (https://github.com/jgarzik/univalue/pull/64). The issue in UniValue has been assigned CVE-2019-18936.

We need to bump our UniValue version to address this issue :)

CVE details submitted to MITRE by @jgarzik:

* Suggested description: `UniValue::read()` in UniValue 1.0.3 and 1.0.4 allows a segfault via malformed JSON.
* Additional Information: UniValue is a JSON I/O library commonly used in cryptocurrency applications.
* VulnerabilityType Other: Denial of Service
* Vendor of Product: univalue
* Affected Product Code Base: univalue - 1.0.4, univalue - 1.0.3
* Affected Component: `UniValue::read()` method
* Attack Type: Context-dependent
* Impact Denial of Service: true
* Attack Vectors: Supply malformed JSON into UniValue's JSON parser.
* Reference: https://github.com/jgarzik/univalue
* Has vendor confirmed or acknowledged the vulnerability?: true
* Discoverer: practicalswift
* Reference: https://github.com/jgarzik/univalue/compare/v1.0.4...v1.0.5, https://github.com/jgarzik/univalue/pull/58
}
        tokenVal = numStr;
        consumed = (raw - rawStart);
        return JTOK_NUMBER;
        }
    case '"': {
        raw++;                                
        std::string valStr;
        JSONUTF8StringFilter writer(valStr);
        while (true) {
            if (raw >= end || (unsigned char)*raw < 0x20)
                return JTOK_ERR;
            else if (*raw == '\\') {
                raw++;                        
                if (raw >= end)
                    return JTOK_ERR;
                switch (*raw) {
                case '"':  writer.push_back('\"'); break;
                case '\\': writer.push_back('\\'); break;
                case '/':  writer.push_back('/'); break;
                case 'b':  writer.push_back('\b'); break;
                case 'f':  writer.push_back('\f'); break;
                case 'n':  writer.push_back('\n'); break;
                case 'r':  writer.push_back('\r'); break;
                case 't':  writer.push_back('\t'); break;
                case 'u': {
                    unsigned int codepoint;
                    if (raw + 1 + 4 >= end ||
                        hatoui(raw + 1, raw + 1 + 4, codepoint) !=
                               raw + 1 + 4)