fix: Q/HPackDecoder limit validation after decoding

[DeagleGross]

There is a discrepancy between Http2Limits.MaxRequestHeaderFieldSize documentation and actual Q/HPackDecoders behavior:

aspnetcore/src/Servers/Kestrel/Core/src/Http2Limits.cs

Lines 84 to 90 in ae31b22

	/// <summary>
	/// Indicates the size of the maximum allowed size of a request header field sequence, in octets. This limit applies to both name and value sequences in their compressed and uncompressed representations.
	/// <para>
	/// Value must be greater than 0, defaults to 2^15 octets (32 KiB).
	/// </para>
	/// </summary>
	public int MaxRequestHeaderFieldSize

MaxRequestHeaderFieldSize clearly states that limits apply to both compressed and uncompressed data, but decoders dont check uncompressed length.

Current PR adds a validation check on uncompressed state and throws a corresponding exception per type.

[Copilot]

Pull request overview

This PR aligns HPACK (HTTP/2) and QPACK (HTTP/3) decoder behavior with Http2Limits.MaxRequestHeaderFieldSize / Http3Limits.MaxRequestHeaderFieldSize documentation by enforcing the header field size limit on decoded (uncompressed) header name/value lengths in addition to the existing encoded (compressed) length checks.

Changes:

• Add post-Huffman-decode validation to ensure decoded header name/value length does not exceed maxHeadersLength.
• Throw HPackDecodingException / QPackDecodingException with the existing net_http_headers_exceeded_length message when the decoded length exceeds the limit.
• Add targeted regression tests for both HPACK and QPACK covering Huffman expansion exceeding the limit.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/Shared/runtime/Http2/Hpack/HPackDecoder.cs	Enforces maxHeadersLength after Huffman decoding for header names/values.
src/Shared/runtime/Http3/QPack/QPackDecoder.cs	Enforces maxHeadersLength after Huffman decoding for header names/values.
src/Shared/test/Shared.Tests/runtime/Http2/HPackDecoderTest.cs	Adds tests proving encoded-length pass + decoded-length fail now throws.
src/Shared/test/Shared.Tests/runtime/Http3/QPackDecoderTest.cs	Adds equivalent tests for QPACK Huffman expansion scenarios.

---

You can also share your feedback on Copilot code review. Take the survey.