feat: limit response body sizes

fasthttp allocates the body from the declared Content-Length before
reading it, so a server could exhaust memory by declaring a size it
never sends. The new max response body config bounds every response,
defaults to 10MiB and accepts sizes like 10MiB or 2MB. Scripts get the
same as a maxBodySize option on http().

internal/script/lua_http.go

@@ -106,6 +106,13 @@ func (e *LuaEngine) parseHTTPOptions(opts *lua.LTable, req *HTTPRequest) error {
 				return
 			}
 			req.MaxRedirects, err = parseHTTPMaxRedirects(float64(count))
+		case httpOptionMaxBodySize:
+			size, ok := v.(lua.LNumber)
+			if !ok {
+				err = types.NewScriptHTTPOptionError(name, types.NewScriptTypeError("number", v.Type().String()))
+				return
+			}
+			req.MaxBodySize, err = parseHTTPMaxBodySize(float64(size))
 		default:
 			err = types.NewScriptHTTPOptionError(name, types.ErrScriptHTTPUnknownOption)
 		}