fix(security): cap hmac-auth body size and truncate prometheus model labels

[AlinsRan]

Summary

Two independent DoS / memory-exhaustion fixes.

Fix 1: hmac-auth — restore max_req_body body-size limit

The hmac-auth plugin had no cap on how much request body was read when validate_request_body = true. An unauthenticated attacker could send an arbitrarily large body and cause the worker to buffer it entirely in memory.

• Added max_req_body field to schema (integer, default 524288 bytes, minimum 1).
• Passed conf.max_req_body to core.request.get_body() inside the body-validation path.

Fix 2: prometheus — truncate model-name labels to prevent cardinality DoS

ctx.var.request_llm_model / ctx.var.llm_model were set directly from the request body's model field and used as Prometheus labels without any length cap. An attacker could inject millions of unique model strings, exhausting the Prometheus shared dict.

• Added MAX_MODEL_LABEL_LEN = 128 constant and model_to_label() helper function that truncates strings to 128 characters and replaces non-scalar types with <non-scalar>.
• Both http_log and inc_llm_active_connections now pass model values through model_to_label() before using them as metric labels.

Changes

• apisix/plugins/hmac-auth.lua: add max_req_body schema field; pass it to get_body()
• apisix/plugins/prometheus/exporter.lua: add model_to_label() helper; apply it at all label sites
• t/plugin/hmac-auth2.t: update schema snapshot to include max_req_body
• t/plugin/hmac-auth3.t: TEST 6 sets up route with max_req_body=10; TEST 7 verifies oversized body rejected; TEST 8 verifies body at exact limit accepted

Tests

• TEST 6–8 in t/plugin/hmac-auth3.t: setup route, reject 11-byte body with limit 10, accept 10-byte body at exact limit.