fix: optimize packages upload memory (#39366)

Bound the memory used when parsing uploaded packages, so instances with
low memory limits survive non-standard packages.

1. Metadata files are read through a size-limited reader, archives
themselves stay unbounded so large payloads keep working
2. zstd decoding caps the window at 128 MiB, the zstd CLI default
3. RPM headers go through a first-party reader with rpmlib's size and
array count limits that allocates only what the upload contains, until
https://github.com/sassoftware/go-rpmutils/pull/44 is released. Signing
still verifies the payload digest, and its signature header matches
rpmsign's byte for byte
4. Swift and NuGet read the zip entry they size-checked, a duplicate
name could stand in for it before
5. Terraform states check `LIMIT_SIZE_TERRAFORM_STATE` before parsing,
NuGet symbol PDBs share a 256 MiB budget
6. Oversized container configs are rejected instead of stored without
metadata, invalid Vagrant boxes answer 400 instead of 500

Signed-off-by: techknowlogick <git@tklk.dev>
Co-authored-by: techknowlogick <git@tklk.dev>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: techknowlogick <techknowlogick@gitea.com>

modules/packages/limited_reader.go

@@ -0,0 +1,31 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package packages
+
+import (
+	"io"
+
+	"gitea.dev/modules/util"
+)
+
+var ErrContentTooLarge = util.NewInvalidArgumentErrorf("content exceeds the size limit")
+
+const MaxMetadataSize = 32 * 1024 * 1024
+
+type limitedReader struct {
+	io.LimitedReader
+}
+
+// NewLimitedReader returns a reader that fails with ErrContentTooLarge once it reads a byte past limit
+func NewLimitedReader(r io.Reader, limit int64) io.Reader {
+	return &limitedReader{io.LimitedReader{R: r, N: limit + 1}}
+}
+
+func (l *limitedReader) Read(p []byte) (int, error) {
+	n, err := l.LimitedReader.Read(p)
+	if l.N == 0 {
+		return max(n-1, 0), ErrContentTooLarge
+	}
+	return n, err
+}