fix(http2): bound header size to 256 KiB

[brianquinlan]

Add maxHeaderListSize setting to ClientSettings and ServerSettings (defaulting to 256 KiB), advertise SETTINGS_MAX_HEADER_LIST_SIZE, enforce it during HPACK decoding, and limit CONTINUATION frame buffering with $O(N)$ defragmentation.

---

• I’ve reviewed the contributor guide and applied the relevant portions to this PR.

Contribution guidelines:

• See our contributor guide for general expectations for PRs.
• Larger or significant changes should be discussed in an issue before creating a PR.
• Contributions to our repos should follow the Dart style guide and use dart format.
• Most changes should add an entry to the changelog and may need to rev the pubspec package version.
• Changes to packages require corresponding tests.

Many Dart repos have a weekly cadence for reviewing PRs - please allow for some latency before initial review feedback.

Note: The Dart team is trialing Gemini Code Assist. Don't take its comments as final Dart team feedback. Use the suggestions if they're helpful; otherwise, wait for a human reviewer.