Add configurable maximum JSON response body size to the streamable HTTP client

[rmarashi]

Problem

The reqwest implementation of StreamableHttpClient parses successful application/json responses with response.json::<ServerJsonRpcMessage>().await and reads non-success bodies with response.text().await. Neither path exposes a byte limit before allocation and deserialization.

A consumer using MCP tools/list against an untrusted remote server therefore cannot enforce a maximum JSON response size through StreamableHttpClientTransportConfig. A request timeout limits elapsed time but not a large response delivered quickly.

Requested capability

Add an opt-in configurable maximum JSON response-body size to the streamable HTTP client transport (or its reqwest backend), enforced before JSON/error-body deserialization.

The implementation should:

• reject an oversized declared Content-Length as an early optimization;
• always count bytes from bytes_stream() and reject once the cumulative limit is exceeded, including chunked/no-length responses;
• apply the bound to successful JSON-RPC and non-success/error response bodies; and
• keep the existing SSE per-event size limit independent, since it solves a different case.

This would let applications cap connector discovery payloads without copying the transport implementation.