docs: settle MAX_REQUEST_BYTES provenance (#573)

[Yatsuiii]

Summary

Records the maintainer decision from #573 in docs/spec/proxy-security.md.

1. Sets MAX_REQUEST_BYTES to 1_000_000 decimal.
2. Records DOS-001 issue HIGH: No request body size limit before JSON parsing — pre-auth OOM via oversized payload (INJECT-001/DOS-001) #147 as the provenance.
3. Documents the derived 500,000 byte string limit.
4. States that MAX_JSON_NESTING_DEPTH and MAX_PARSE_TIME_MS must be evaluated against the 1MB cap.
5. Keeps the 10MB value as a separate resource and denial of service design decision.

No runtime code changed.

Verification

The change is limited to docs/spec/proxy-security.md.

Closes #573.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[imran-siddique]

Verified against both implementations and the DOS-001 provenance in #147/#573. The patch correctly documents the enforced decimal 1,000,000-byte cap and derived 500,000-byte string limit.