feat(http): decouple upload size limit from maxReqSize and harden file upload (#4780)

- Add maxUploadSize config (default 1GB) for custom HttpBody streaming uploads;
  maxReqSize now only controls in-memory buffering threshold
- Reject uploads exceeding maxUploadSize with 413 before writing any data
- Delete incomplete files on HttpFileStorage destruction
- Open HttpFileStorage in "wb" mode instead of "ab" to avoid stale data
- Pass content_size to writeData() for integrity validation
- Use uint64_t for content_len to support large file uploads
- Wrap HttpBody _on_completed callback in try-catch to prevent unhandled exceptions
- Make GET_CONFIG global variables read-only
- Update ZLToolKit submodule

---------

Co-authored-by: xiongziliang <771730766@qq.com>

server/WebApi.cpp

@@ -1488,7 +1488,8 @@ void installWebApi() {
             // Compatible with old version requests, the new version removes the only_audio parameter and adds the only_track parameter
             only_track = 1;
         }
-        GET_CONFIG(std::string, local_ip, General::kListenIP)
+        GET_CONFIG(std::string, s_local_ip, General::kListenIP)
+        auto local_ip = s_local_ip;
         if (!allArgs["local_ip"].empty()) {
             local_ip = allArgs["local_ip"];
         }