fix(formmailer): cap request body with MaxBytesReader

ParseMultipartForm(maxFormSize) caps post-header bytes but doesn't
bound the raw body transfer, so a slow/chunked POST can burn server
time before rejection. Wrap r.Body in http.MaxBytesReader so the
transport cuts off over-size bodies immediately.

net/formmailer/formmailer.go

@@ -208,6 +208,7 @@ func (fm *FormMailer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	r.Body = http.MaxBytesReader(w, r.Body, maxFormSize)
 	if err := r.ParseMultipartForm(maxFormSize); err != nil {
 		http.Error(w, "form too large or invalid", http.StatusBadRequest)
 		return