fix(processor): bound decompressed document size to prevent decompression bombs

[kanywst]

Description of the PR

decompressDocument read the bzip2/zstd stream with io.ReadAll and no size limit, so a small compressed document could expand to an arbitrary size and exhaust the processor's memory. The encoding is auto-detected from the blob's magic bytes, so any ingested artifact can reach this path.

This bounds the decompressed size with io.LimitReader and rejects documents that exceed the limit, matching the object-size handling already used by the blob collector (pkg/handler/collector/blob/blob.go). A 56 KB zstd input previously materialized 500 MiB in memory; it is now rejected once it passes the limit.

Fixes #3075

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If GraphQL schema is changed, GraphQL client updates/additions have been made
• If OpenAPI spec is changed, make generate has been run
• If ent schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged