fix(middleware): BodyLimit can be bypassed by a single oversized Read

[liuyuyan2717]

Description

limitedReader.Read had two defects that allowed callers following standard io.Reader semantics (process n>0 bytes before checking err) to read arbitrarily far past the configured BodyLimit:

1. Unbounded single read. Read forwarded the caller's full buffer to the underlying reader, so a single large Read could return enough data to both cross the limit and complete a value (e.g. a JSON object parsed by encoding/json.Decoder).
2. Non-sticky error. After returning the limit-exceeded error once, subsequent Read calls continued returning real data instead of sticking at (0, err).

Fix

Mirror net/http.MaxBytesReader:

• Bound each Read to at most remaining + 1 bytes, so a single call can never both cross the limit and complete a value.
• Make the error sticky: once tripped, every subsequent Read returns (0, ErrStatusRequestEntityTooLarge) with no additional data.

Test coverage

Added three tests:

• TestBodyLimitReader_stickyError — verifies post-limit reads always return 0 bytes
• TestBodyLimitReader_boundedRead — verifies single large reads are capped at remaining+1
• TestBodyLimit_readAfterLimitNoLeak — integration test with chunked encoding, simulating an io.Reader-compliant consumer

Fixes #3071

Checklist

• Code compiles correctly
• Added tests that fail without the fix
• All existing tests should still pass