docs: add request body size limitation

[pellared]

Per #781 (comment)

Add response body size limitation to mitigate memory usage risks

Reference: https://cwe.mitre.org/data/definitions/789.html

The values are taken from otlpreceiver defaults which are

• gRPC - 4MiB (I think it would better be 20 MiB)
• HTTP - 20 MiB

[pellared]

I am worried that the value is too small for profiles. However, I wanted to use the Collector defaults for initializing the conversation. Should we change it to 20 MiB? This would also follow the pattern from #781 where we agreed on the same size for gRPC and HTTP.

CC @open-telemetry/collector-maintainers @open-telemetry/profiling-maintainers

[Copilot]

Pull request overview

Updates the OTLP specification documentation to define request size/body limits for OTLP/gRPC and OTLP/HTTP, aiming to reduce memory-exhaustion risk from oversized payloads.

Changes:

• Documented an OTLP/gRPC request message size limit recommendation (4 MiB) and client behavior on oversize errors.
• Documented an OTLP/HTTP request body size limit recommendation (20 MiB) and recommended HTTP 413 handling semantics.
• Added an Unreleased changelog entry for the documentation update.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
docs/specification.md	Adds normative guidance for gRPC request message size limits and HTTP request body limits.
CHANGELOG.md	Records the docs change in the Unreleased “Added” section.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

In the gRPC request size-limit rationale, the actor is incorrect: excessive memory usage here would be caused by a misconfigured or malicious client sending an oversized request, not by a misconfigured/malicious server. This should be corrected to avoid confusing implementers about the threat model and responsibility.

Suggested change

	server. The server implementations typically enforce a default incoming message
	size limit of 4 MiB, which is acceptable to use. If the limit is exceeded, the
	client MUST treat the error as not-retryable. Note that in such a scenario,
	client sending an oversized request. The server implementations typically enforce
	a default incoming message size limit of 4 MiB, which is acceptable to use. If the
	limit is exceeded, the client MUST treat the error as not-retryable. Note that in