feat: limit response body sizes

fasthttp allocates the body from the declared Content-Length before
reading it, so a server could exhaust memory by declaring a size it
never sends. The new max response body config bounds every response,
defaults to 10MiB and accepts sizes like 10MiB or 2MB. Scripts get the
same as a maxBodySize option on http().

internal/sarin/helpers.go

@@ -1,6 +1,7 @@
 package sarin
 
 import (
+	"math"
 	"math/rand/v2"
 	"time"
 )
@@ -19,3 +20,17 @@ func firstOrEmpty(values []string) string {
 	}
 	return values[0]
 }
+
+func safeUintToInt(u uint) int {
+	if u > math.MaxInt {
+		return math.MaxInt
+	}
+	return int(u)
+}
+
+func safeUint64ToInt(u uint64) int {
+	if u > math.MaxInt {
+		return math.MaxInt
+	}
+	return int(u)
+}