Large-window Brotli bodies bypass decompression memory limits

Summary

With the `compress-brotli` feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurrent requests can exhaust process or host memory.

Actix Web enables Brotli support by default. Applications that read request bodies through `Bytes`, `String`, `Json`, or `Form` can be affected even when extractor size limits are configured. The allocation occurs before the handler runs, so authentication performed in the handler does not prevent it.

Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with `Content-Encoding: br` at a reverse proxy or in middleware before body extraction, or disable the `compress-brotli` feature throughout the dependency graph.