Limit body size for all requests

Summary

Gotify Server's plugin configuration update feature accepts
attacker-controlled YAML bodies at POST /plugin/{id}/config.
Confirmed in v2.9.1, when registration=true and at least one
installed plugin supports Configurer, an unauthenticated remote
attacker can self-register and submit an oversized configuration body to
trigger severe memory pressure and persistent configuration storage
growth.

Details

UpdateConfig verifies plugin ownership and Configurer support, but
then immediately calls io.ReadAll(ctx.Request.Body) with no size
limit. The full request body is buffered before YAML parsing or
plugin-side validation, so any reachable caller can force memory
allocation proportional to the submitted body size. After validation,
the handler stores the original bytes in conf.Config, which turns the
same endpoint into a persistence amplifier rather than only a transient
parse-time sink.

conf, err := c.DB.GetPluginConfByID(id)
...
if aborted := supportOrAbort(ctx, instance, compat.Configurer); aborted { return }
newconfBytes, err := io.ReadAll(ctx.Request.Body)
...
if err := yaml.Unmarshal(newconfBytes, newConf); err != nil { ... }
if err := instance.ValidateAndSetConfig(newConf); err != nil { ... }
conf.Config = newconfBytes

When registration=true, POST /user is reachable under
authentication.Optional() and allows unauthenticated non-admin
account creation. User creation triggers fireUserAdded, which
initializes per-user instances for all installed plugins, and
RequireClient accepts Basic Auth directly. The attacker can then call
GET /plugin to enumerate a plugin instance whose capabilities
include configurer, fetch the current YAML from
GET /plugin/{id}/config, and reuse that id against
POST /plugin/{id}/config.

Because the handler stores raw YAML bytes rather than a normalized
representation, the attacker can append large YAML comment blocks to an
otherwise valid configuration. yaml.Unmarshal ignores comments, but
the oversized original document is still persisted as
PluginConf.Config. I verified the unbounded body read and raw-byte
persistence in api/plugin.go, and the self-registration plus Basic
Auth reachability in api/user.go, router/router.go,
auth/authentication.go, and plugin/manager.go. I did not identify
a fixed version from the current materials.

PoC

1. Ensure the target runs Gotify Server v2.9.1 with
   registration=true and at least one installed plugin whose
   /plugin entry lists configurer in capabilities.

2. Create a normal account:

POST /user
Content-Type: application/json

{"name":"pocuser","pass":"PocPassw0rd!"}

3. Use Basic Auth for that account to call GET /plugin, select an
   entry whose capabilities array contains configurer, then fetch
   its current YAML from GET /plugin/{id}/config.

4. Append a large number of YAML comment lines to the returned document
   and submit it back:

POST /plugin/{id}/config
Authorization: Basic <base64(pocuser:PocPassw0rd!)>
Content-Type: application/x-yaml

<original valid YAML>
# padding 000001
# padding 000002
...

5. Observe high memory pressure during the request. If the YAML remains
   otherwise valid, a subsequent GET /plugin/{id}/config returns the
   enlarged document, confirming that the oversized raw body was
   persisted.

Impact

Observed impact is a conditional unauthenticated network denial of
service in deployments that allow self-registration and have at least
one installed Configurer plugin: a remote attacker can consume
process memory with a single oversized request and can repeatedly
enlarge persisted plugin configuration data. Where registration is
disabled, the same bug remains reachable to a low-privilege
authenticated user. I did not confirm confidentiality or integrity
impact from current evidence.