fix(network): bound chunked relay memory

[pimlock]

🔧 security-fix-agent

Summary

Bound memory used while relaying HTTP/1 chunked bodies. Chunk payloads now pass through a fixed 8 KiB buffer, while chunk framing and trailers have explicit limits.

Related Issue

No public issue. This change addresses a privately tracked security finding under the repository security-reporting policy.

Changes

• Stream chunk payloads without retaining the declared chunk in a growable buffer
• Limit chunk-size lines to 16 KiB
• Limit trailer blocks to 16 KiB and 128 fields
• Add regression tests for incomplete maximal chunks and framing limits
• Document the chunked-relay limits in the sandbox resource model

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable; the parser boundary is covered by unit tests)
• cargo test -p openshell-supervisor-network --lib
• mise run test (blocked by missing host mke2fs or mkfs.ext4 in five unrelated VM-driver tests)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[pimlock]

/ok to test e03c6dd

[github-actions]

Label test:e2e applied, but pull-request/3537 does not exist yet. A maintainer needs to comment /ok to test e03c6ddb0b8638866c98fa3242fe65a9e935d45f to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.