Parse one item starting at `pos`, returning it and the position just past it. The input is a single well-formed definite-length CBOR value, so no indefinite framing is encountered here.
(b: &[u8], pos: usize)
Source from the content-addressed store, hash-verified