Merge pull request #31175 from ankush/recursive_non_explosive_bom

fix: allow recursive BOMs as long as they don't recursively explode