fix: reject multipart bodies without Content-Length (post_max_size bypass on PHP 7.4) #591

Follow-up to #586, from review #586 (review).

Problem

On 22.04 (PHP 7.4 with the CVE-2026-109618/-109619 mitigation), post_max_size is only checked against the
Content-Length header. If the multipart body is chunked, or arrives over HTTP/2 without a length, PHP reads it until
it hits memory_limit. On that branch hitting the limit means _exit(1): an unauthenticated worker kill per request,
with no error page and no log entry. PHP 8.3 on 24.04 also checks while reading the body, so it is not affected.

Proposed fix

Next to the php_admin_value lines in the vhost (LimitRequestBody 0 must stay because of WebDAV PUT and WOPI):

# PHP 7.4 only bounds multipart bodies by Content-Length; a chunked or
# HTTP/2 body without one is parsed until memory_limit is hit.
<If "req('Content-Type') =~ m#^multipart/form-data#i && -z req('Content-Length')">
  Require all denied
</If>

Verification

• Reproduce the worker kill on 22.04 without the block: 150 MB multipart, -H 'Transfer-Encoding: chunked'
• With the block, the request is rejected on 22.04 and 24.04
• Regular uploads, chunked WebDAV PUT, WOPI save and login still work

Also in scope (non-blocking review points)

• Validate OWNCLOUD_POST_MAX_SIZE in 10-base.sh (^[1-9][0-9]*[KkMmGg]?$). 100MB currently means 100 bytes,
  and 0 or a negative value means unlimited. Warn if the value is above a quarter of the effective memory_limit.
• Set explicit max_multipart_body_parts / max_file_uploads. The defaults are about 1020; core only ever
  uploads one file per form.
• CHANGELOG: on 22.04, hitting memory_limit is a silent process exit (no error page, no owncloud.log).