Add a userwritebytes statistic, the write-path mirror of the shipped
userquerybytes measurement, gated behind a new opt-in [http]
user-write-bytes-enabled flag. When enabled, every v1, v2, and Prometheus
remote write adds its request body bytes to a per-user counter, reported as
one userwritebytes statistic per user, tagged with the user name, and visible
through SHOW STATS and /debug/vars (admin-gated only when pprof-auth-enabled
is set; otherwise /debug/vars is unauthenticated). Unauthenticated writes are
attributed to "(anonymous)". Bytes are counted at the same sites that feed
the aggregate writeReqBytes field of the httpd statistic, so the per-user
values sum exactly to the global counter. Behavior is unchanged by default.

The counters inherit the existing writeReqBytes units: /write counts post-gzip
decompressed bytes while the Prometheus endpoint counts compressed wire bytes,
and tests pin both so changing that inconsistency becomes a conscious
decision. New tests cover the sum invariant, anonymous attribution, concurrent
writes under the race detector, early-error paths that must count nothing, and
/debug/vars visibility under both pprof-auth modes (admin-gated and the
unauthenticated default). The test harness gains a WriteAuthorizer
mock, previously declared but never wired, making authenticated write paths
testable for the first time. The per-user statistic emission in
Handler.Statistics is extracted into a helper shared with userquerybytes, and
both flags are now documented in the sample config.

This also fixes a pre-existing gap where gzip request bodies bypassed the
MaxBodySize limit: truncateReader now wraps the decompressed stream, so an
oversized gzip body is rejected with 413 rather than buffered in full.

Closes https://github.com/influxdata/feature-requests/issues/692