BSON and Protobuf binders used io.ReadAll with no cap. Add
binding.MaxBodyBytes (default 0, unlimited) and a shared reader so
apps can bound those binders without changing historical defaults.
Oversized bodies return *http.MaxBytesError, which MustBindWith
already maps to HTTP 413.
Fixes#4759
Signed-off-by: elix3r <157088510+22elix3r@users.noreply.github.com>