feat: limit response body sizes

fasthttp allocates the body from the declared Content-Length before
reading it, so a server could exhaust memory by declaring a size it
never sends. The new max response body config bounds every response,
defaults to 10MiB and accepts sizes like 10MiB or 2MB. Scripts get the
same as a maxBodySize option on http().

internal/script/js_http.go

@@ -117,6 +117,16 @@ func (e *JsEngine) parseHTTPOptions(opts *goja.Object, req *HTTPRequest) error {
 			if req.MaxRedirects, err = parseHTTPMaxRedirects(count); err != nil {
 				return err
 			}
+		case httpOptionMaxBodySize:
+			size, ok := numberValue(value)
+			if !ok {
+				return types.NewScriptHTTPOptionError(name, types.NewScriptTypeError("number", jsTypeName(value)))
+			}
+
+			var err error
+			if req.MaxBodySize, err = parseHTTPMaxBodySize(size); err != nil {
+				return err
+			}
 		default:
 			return types.NewScriptHTTPOptionError(name, types.ErrScriptHTTPUnknownOption)
 		}