fix: bound HTTPServer request resources

[zeitlinger]

Summary

• use a fixed-size default executor with a bounded queue and non-blocking rejection
• close rejected authenticated request bodies instead of draining an unbounded body
• close rejected exchanges after sending HTTP 403

This is the focused replacement for the #2284 portion of #2297.

Fixes #2284

Ongoing discussion

None currently. Earlier review feedback about preserving default concurrency and closing rejected exchanges is incorporated here.

Validation

• mise run lint:fix
• mise run build
• ./mvnw test -pl prometheus-metrics-exporter-httpserver -Dcoverage.skip=true -Dcheckstyle.skip=true

[github-actions]

⚠️ API changes detected — maintainer review required

This PR modifies the published API diff for the following module(s):

• prometheus-metrics-exporter-httpserver

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.