docs: add response body size limitation

[pellared]

Add response body size limitation to mitigate memory usage risks

Reference: https://cwe.mitre.org/data/definitions/789.html

OTel implementations:

• limit response body size for OTLP HTTP exporters opentelemetry-go#8108
• [OTLP] Limit response body size read by exporters opentelemetry-dotnet#7017
• Response body bounds opentelemetry-java#8224

Follow-ups

• Add limit for request on the server side (and client side?) docs: add response body size limitation #781 (comment)
  • docs: add request body size limitation #782
• Create issues for all SDKs docs: add response body size limitation #781 (comment)
• Add limit for response on server side docs: add response body size limitation #781 (comment)

[Copilot]

Pull request overview

Adds a specification requirement for clients to cap OTLP response parsing size (including post-decompression) to mitigate excessive memory usage risks (CWE-789).

Changes:

• Add normative guidance to limit OTLP/gRPC response parsing size (recommended 32 KiB) and treat oversize responses as non-retryable.
• Add the same response-size-limiting guidance to OTLP/HTTP responses.
• Document the change in the Unreleased changelog.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
docs/specification.md	Adds client-side response size limit requirements for both gRPC and HTTP OTLP responses.
CHANGELOG.md	Notes the documentation/spec update in the Unreleased section.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pellared]

Do we also want to have something like (as a separate PR):

The server MUST limit the size of the request body when parsing it, including
after decompression, to mitigate possible excessive memory usage caused by a misconfigured or malicious client. It is RECOMMENDED to limit the request body to 64 MiB.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tigrannajaryan]

For consistency we also need to mention request size limitation enforcement for servers.

[tigrannajaryan]

@pellared can you open issues in all other language SDKs to get this applied?

AFAIK, Collector already enforces limits.

[pellared]

For consistency we also need to mention request size limitation enforcement for servers.

@tigrannajaryan, see #781 (comment)

I am going to create a separate PR tomorrow. Added as a follow-up in PR description.

[pellared]

@pellared can you open issues in all other language SDKs to get this applied?

AFAIK, Collector already enforces limits.

@tigrannajaryan, I can do it once this PR is merged. Added as a follow-up in PR description.

[pellared]

Do we also want to add some requirement that the server should not respond with content bigger than 4MB? Added as a follow-up in PR description as I do not want to scope creep this PR (also it has already a good amount of approvals).