Harden against resource exhaustion: partial blobs, artifact size, concurrent diffs

[simonchrz]

Three hardening changes against resource exhaustion. Any client that can reach the proxy can trigger these, and /ui has no authentication. Each change is its own commit.

Changes

Abort blob writes when the download fails

• gocloud commits whatever a writer has received when it is closed, unless its context was cancelled first.
• Store closed the writer after a failed copy, so every download that broke off midway left a partial object at its fetch path. That object was never served and never deleted.
• Store now cancels the writer's context before closing it.

Add a size limit for upstream artifacts

• New artifact_max_size / PROXY_ARTIFACT_MAX_SIZE. Unlimited by default, so existing setups behave as before. Negative or unparseable values fail validation.
• A declared Content-Length over the limit is refused before the body is read. An artifact of unknown size fails once the download passes the limit. Nothing is cached and the client gets a 502.
• The limit is applied as a fetcher wrapper (handler.LimitArtifactSize), so stored, streamed and mirrored artifacts all honour it.
• Documented in docs/configuration.md and config.example.yaml.

Limit how many version diffs run at once

• compareDiff buffers both archives whole, up to 512 MB each, so a few parallel compares of large cached versions could exhaust memory.
• At most two diffs run at once. Further requests get an immediate 503 with code BUSY and Retry-After: 5 rather than queueing.
• The 512 MB per-archive cap stays, because legitimately large packages need it.
• Swagger docs are regenerated for the new response.

Testing

Each new test was first run against a no-op stub, to check it fails on the missing behaviour:

• TestBlobStoreFailedCopyLeavesNoObject: "failed Store left a partial object behind".
• Size limit, declared, undeclared, stored and streamed cases: e.g. "Fetch error = , want ErrArtifactTooLarge".
• Compare limiter: "status with all slots taken = 200, want 503", plus a test that a finished comparison frees its slot.

go test -race ./..., go vet and golangci-lint v2.13.1 pass.