Unify and harden HTTP server request limits

[stefanprodan]

This PR applies defense-in-depth hardening to the two HTTP servers exposed by the controller:

• Limit the event server request body size to 3MiB (ported from receiver server)
• Unify request body limit enforcement in a shared helper used by both servers, rejecting oversized bodies with HTTP 413 status code.
• Enforce the receiver body limit before the receiver lookup and payload validation.
• Set ReadTimeout (30s), ReadHeaderTimeout (10s) and MaxHeaderBytes (256 KiB) on both servers.
• Bound the event rate limiter store memory by sweeping stale entries at the configured --rate-limit-interval and purging them after 2x interval.
• Bump sethvargo/go-limiter from v1.1.0 to v1.2.0, which reduces lock contention in the store.

[fluxcdbot]

Backport failed for release/v1.9.x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release/v1.9.x
git worktree add -d .worktree/backport-1361-to-release/v1.9.x origin/release/v1.9.x
cd .worktree/backport-1361-to-release/v1.9.x
git switch --create backport-1361-to-release/v1.9.x
git cherry-pick -x 8bb6b148850ce58d2de938bfa81d35acff56e286 6662c7810314bc5d677785c46caaab77e25d2fb5 c80e3914b5440d6568aeff91649d8deb30294c26