Limit HTTP request bodies before MCP middleware parsing

[SamMorrowDrums]

Describe the bug

HTTP middleware reads request bodies before the SDK request-size guard applies. Large bodies can therefore consume substantially more memory than necessary. Apply a bounded read before parsing in every middleware path that consumes the body, and return a clear request-too-large response.

Affected version

Current main as of 2026-08-19.

Steps to reproduce the behavior

1. Run the HTTP transport.
2. Send an oversized MCP request body.
3. Observe that middleware reads the complete body before downstream size enforcement.

Expected vs actual behavior

Expected: HTTP request bodies are bounded before any middleware reads or buffers them.

Actual: middleware can buffer an unbounded body first.

Logs

N/A