fix(admin): enforce response body size limit on automatic swagger doc pull

[wy471x]

PullSwaggerDocServiceImpl previously called response.body().string() with no size limit, allowing a malicious upstream to exhaust admin memory. Extract readLimitedResponseBody to a public static method in HttpUtils with Content-Length pre-check and streaming byte-count enforcement, reuse it in both SwaggerImportServiceImpl and PullSwaggerDocServiceImpl, and gate it with the existing shenyu.swagger.max-body-size property (default 10 MB).

Make sure that:

• You have read the contribution guidelines.
• You submit test cases (unit or integration tests) that back your changes.
• Your local test passed ./mvnw clean install -Dmaven.javadoc.skip=true.

Summary of all changes:

Problem

PullSwaggerDocServiceImpl called response.body().string() directly, loading the entire
upstream API document response into memory with no size limit. A malicious or
misconfigured upstream could cause excessive memory usage in shenyu-admin.

Solution

3 production files changed, 2 test files changed:

1. HttpUtils.java — Extracted readLimitedResponseBody() as a public static method
   (moved from SwaggerImportServiceImpl where it was private). Implements two-layer
   defense: early rejection via Content-Length header check, and streaming byte-count
   enforcement. Pre-allocates ByteArrayOutputStream when contentLength is known to avoid
   repeated buffer resizing.
2. SwaggerImportServiceImpl.java — Delegates to HttpUtils.readLimitedResponseBody()
   instead of the removed private method. Removed unused imports, the READ_BUFFER_SIZE
   constant, and the dead DEFAULT_MAX_SWAGGER_BODY_SIZE constant.
3. PullSwaggerDocServiceImpl.java — The core fix. Added
   @value("${shenyu.swagger.max-body-size:10485760}") injection and replaced
   response.body().string() with HttpUtils.readLimitedResponseBody(response.body(),
   maxSwaggerBodySize). Oversized responses are caught by the existing catch (Exception
   e) block and logged gracefully.
4. HttpUtilsTest.java — 8 new tests for readLimitedResponseBody: within-limit,
   exact-limit boundary, Content-Length rejection, streaming rejection, null body,
   negative max size, charset handling (ISO-8859-1), and default UTF-8 fallback.
5. SwaggerImportServiceImplTest.java — Removed 3 reflection-based tests that called
   the now-deleted private method (covered by HttpUtilsTest). Moved service creation to
   @beforeeach with ReflectionTestUtils.setField to simulate Spring injection of the
   default 10 MB limit.

close #6444

[Aias00]

hi, sorry to bother. i forget have you ever add my wechat: aias00?

[dengliming]

@wy471x Could you please resolve this conflict?

[wy471x]

@wy471x Could you please resolve this conflict?

I have resolved the conflict.