Add MAX_API_RESPONSE_SIZE bounds check in papi.c

Reject API responses larger than 256MB before malloc().
Prevents DoS via malicious response size from server.

Fixes #245

pclsync/papi.c

@@ -28,6 +28,8 @@
 */
 
 #include <stddef.h>
+
+#define MAX_API_RESPONSE_SIZE (256 * 1024 * 1024) // 256MB
 #include <stdio.h>
 #include <string.h>
 
@@ -396,6 +398,12 @@ binresult *papi_result(psock_t *sock) {
     return NULL;
   }
 
+  if (ressize > MAX_API_RESPONSE_SIZE) {
+    pdbg_logf(D_WARNING, "API response size %u exceeds limit %u, rejecting",
+              ressize, MAX_API_RESPONSE_SIZE);
+    return NULL;
+  }
+
   data = (unsigned char *)malloc(ressize);
 
   if (pdbg_unlikely(psock_readall(sock, data, ressize) != ressize)) {