fix(sources): cap compressed and decompressed payload size to prevent OOM

[harshvardhan-s1]

Sources that decompress untrusted input fed client-controlled payloads into
unbounded read_to_end calls, letting a small upload drive an arbitrarily large
allocation and OOM-kill the daemon. Port upstream's CappedDecoder
(vectordotdev/vector#25819, commit 3162ed1a2e) into vector-common and apply it
at every affected call site.

The cap defaults to 100 MiB and is tunable with --max-decompressed-size-bytes /
VECTOR_MAX_DECOMPRESSED_SIZE_BYTES. Oversized payloads are rejected rather than
buffered. For zstd the decoder window is clamped as well, since a crafted frame
allocates its window before emitting any output and so escapes an output-size
cap entirely; under HTTP the clamp follows RFC 9659's 8 MB ceiling.

Tickets fixed:

• OBE-11554
• OBE-11237
• OBE-11233
• OBE-10708 — same call site as OBE-11233
• OBE-10706
• OBE-10711
• OBE-10710
• OBE-11557