Prevent unbounded request body reads

[mikelolasagasti]

Add a -max-body-size flag with a 32 MiB default and allow 0 to preserve unlimited behavior. Return 413 for oversized requests and cover both rejection and normal request paths with tests.

Fixes #756

[moorereason]

I would set the default to 0 (unlimited) so that we don't introduce a breaking change.

A future major release could change the default to be non-zero.

[mikelolasagasti]

I evaluated that as an option while creating the patch, but I think it's better to force a new release with the limitation by default.

Let's see if @adnanh review the patch and decides what's best. I don't mind to change if that allows this PR to be accepted.

[adnanh]

First, thanks for the contribution!

I agree with @moorereason, I've always tried hard to keep the default behavior consistent, even if it's not a good practice. The flag will be there, people can use it, we can recommend using it and maybe introduce a "this behavior will change in the future" warning, but it shouldn't definitely silently break after next release :-)

[mikelolasagasti]

Restored the unlimited default and added a warning at startup when maxBodySize is unlimited.

[adnanh]

Looking great overall, just one small nitpick.

Also, maybe we should look into adding a configurable read timeout as well to prevent attacks that keep the connection indefinitely open while still maintaining request body size within the specified limits?

I would do that in a separate PR anyway, just a thought as it's sort of related to this one :-)

[mikelolasagasti]

Agree on adding a configurable read timeout, but as you mention should be a separated PR. I can work on that after this one is merged.