Limit add-chain/add-pre-chain request body size to prevent memory exh…

[ztzat089-ctrl]

Summary

This PR fixes an unbounded memory allocation vulnerability in the add-chain
and add-pre-chain HTTP handlers. ParseBodyAsJSONChain reads the entire
request body via io.ReadAll(r.Body) without any size limit, allowing a
malicious client to send an oversized request and exhaust server memory.

Fix

Applies http.MaxBytesReader to r.Body before it reaches
ParseBodyAsJSONChain, limiting the body to 512000 bytes (matching the
existing maxAddChainBodyBytes constant already used in
submission/proxy_server.go). The error-handling code in addChainInternal
already expected an http.MaxBytesError, but nothing triggered it on the
direct CTFE path — only the proxy path was protected.

Testing

• go build ./trillian/ctfe/... passes
• go test ./trillian/ctfe/... passes (all existing tests pass)

Related

Reported via Google OSS VRP, Issue Tracker #542934724.