docs: add response size limitation

[pellared]

Add response body size limitation to mitigate memory usage risks

Reference: https://cwe.mitre.org/data/definitions/789.html

OTel implementations:

• limit response body size for OTLP HTTP exporters opentelemetry-go#8108
• [OTLP] Limit response body size read by exporters opentelemetry-dotnet#7017
• Response body bounds opentelemetry-java#8224
• Add bounding for OTLP response body opentelemetry-kotlin#361
• fix(otlp-exporter-base): limit Node.js HTTP transport response body to 4 MB opentelemetry-js#6552

Follow-ups

• Add limit for request on the server side (and client side?) docs: add response size limitation #781 (comment)
  • docs: add request size limitation #782
• Create issues for all SDKs docs: add response size limitation #781 (comment)
  • All SIGs have been already been notified (even a few times).
• Add limit for response on server side docs: add request size limitation #782
• Change wording (not-retryable -> non-retryable) docs: add response size limitation #781 (comment)

[Copilot]

Pull request overview

Adds a specification requirement for clients to cap OTLP response parsing size (including post-decompression) to mitigate excessive memory usage risks (CWE-789).

Changes:

• Add normative guidance to limit OTLP/gRPC response parsing size (recommended 32 KiB) and treat oversize responses as non-retryable.
• Add the same response-size-limiting guidance to OTLP/HTTP responses.
• Document the change in the Unreleased changelog.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
docs/specification.md	Adds client-side response size limit requirements for both gRPC and HTTP OTLP responses.
CHANGELOG.md	Notes the documentation/spec update in the Unreleased section.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pellared]

Do we also want to have something like (as a separate PR):

The server MUST limit the size of the request body when parsing it, including
after decompression, to mitigate possible excessive memory usage caused by a misconfigured or malicious client. It is RECOMMENDED to limit the request body to 64 MiB.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pellared]

Do we also want to add some requirement that the server should not respond with content bigger than 4MB? Added as a follow-up in PR description as I do not want to scope creep this PR (also it has already a good amount of approvals).