fix(http): bound response body reads to 4 MB

[karan-vk]

Fixes #3439

Changes

Response bodies in the reqwest, reqwest-blocking and hyper clients are now read incrementally and truncated at 4 MB instead of being buffered without bound, so a misbehaving or malicious endpoint cannot exhaust memory. The hyper client no longer reads response bodies for non-success statuses.

Follows the review feedback on the stale predecessor #3501:

• The limit is enforced while reading in opentelemetry-http, not checked after the body is already in memory
• 4 MB matches the limit picked by the .NET SDK
• Truncation is deliberately not an error, so an oversized response cannot trigger exporter retries; the OTLP partial-success parse of a truncated body logs and never fails the export
• Read and frame errors are propagated instead of returning a silently truncated body
• Buffers are pre-allocated from the content-length hint, capped at the limit

Merge requirement checklist

• CONTRIBUTING guidelines followed
• Unit tests added/updated (if applicable)
• Appropriate CHANGELOG.md files updated for non-trivial, user-facing changes
• Changes in public API reviewed (if applicable) - no public API changes

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.3%. Comparing base (0e78170) to head (e771cf4).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #3604     +/-   ##
=======================================
+ Coverage   83.2%   83.3%   +0.1%     
=======================================
  Files        130     130             
  Lines      28246   28349    +103     
=======================================
+ Hits       23506   23636    +130     
+ Misses      4740    4713     -27     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.