While auditing the Bitcoin Core RPC code I found an issue in UniValue. `UniValue::read()` in UniValue 1.0.3 and 1.0.4 allows a segfault via high object depth JSON.

Live demo:

```
$ src/bitcoind -regtest -rpcuser=u -rpcpassword=p > /dev/null &
[1] 8625
$ curl -u u:p --request POST \
      --data $(python -c 'print(50000 * "[");') http://127.0.0.1:18443
curl: (52) Empty reply from server
[1]+  Segmentation fault      (core dumped) src/bitcoind -regtest -rpcuser=u -rpcpassword=p > /dev/null
```

I reported the issue to `security@` and UniValue author @jgarzik back in early November 2019. The issue was fixed in commit https://github.com/jgarzik/univalue/commit/fe2227d4ace9d4d5b30710684c9d3b1012e3c0fc (https://github.com/jgarzik/univalue/pull/64). The issue in UniValue has been assigned CVE-2019-18936.

We need to bump our UniValue version to address this issue :)

CVE details submitted to MITRE by @jgarzik:

* Suggested description: `UniValue::read()` in UniValue 1.0.3 and 1.0.4 allows a segfault via malformed JSON.
* Additional Information: UniValue is a JSON I/O library commonly used in cryptocurrency applications.
* VulnerabilityType Other: Denial of Service
* Vendor of Product: univalue
* Affected Product Code Base: univalue - 1.0.4, univalue - 1.0.3
* Affected Component: `UniValue::read()` method
* Attack Type: Context-dependent
* Impact Denial of Service: true
* Attack Vectors: Supply malformed JSON into UniValue's JSON parser.
* Reference: https://github.com/jgarzik/univalue
* Has vendor confirmed or acknowledged the vulnerability?: true
* Discoverer: practicalswift
* Reference: https://github.com/jgarzik/univalue/compare/v1.0.4...v1.0.5, https://github.com/jgarzik/univalue/pull/58
consumed = (raw - rawStart);
            return JTOK_KW_TRUE;
        } else if (!strncmp(raw, "false", 5)) {
            raw += 5;
            consumed = (raw - rawStart);
            return JTOK_KW_FALSE;
        } else
            return JTOK_ERR;
    case '-':
    case '0':
    case '1':
    case '2':
    case '3':
    case '4':
    case '5':
    case '6':
    case '7':
    case '8':
    case '9': {
        
        std::string numStr;
        const char *first = raw;
        const char *firstDigit = first;
        if (!json_isdigit(*firstDigit))
            firstDigit++;
        if ((*firstDigit == '0') && json_isdigit(firstDigit[1]))
            return JTOK_ERR;
        numStr += *raw;                       
        raw++;
        if ((*first == '-') && (raw < end) && (!json_isdigit(*raw)))