amp-autocomplete: should not fetch remote data if min-characters constraint is not satisfied.

### Description

As observed:

- amp-autocomplete has an attribute min-characters which does not show the results in Gmail inbox if no. of characters typed are less than the attribute value; which is fine
- but it actually hits the src endpoint to fetch remote data even if there is no intention of showing that data in inbox
- ideally, min-characters value should be honoured before fetching remote data.
- this increases the number of API hits tremendously

Also, what kind of security measures should be taken to avoid any misuse of API's. Refer https://github.com/ampproject/wg-amp4email/issues/19, not implementation details present.

### Reproduction Steps

```

### Relevant Logs

_No response_

### Browser(s) Affected

_No response_

### OS(s) Affected

_No response_

### Device(s) Affected

_No response_

### AMP Version Affected

_No response_

Start at the amp-autocomplete component entry point and reproduce the example with min-characters="3" and a remote src endpoint. Verify that typing fewer than three characters makes no request while reaching the threshold still fetches and displays results; the security question is noted but has no implementation details.

Written by the indexing model from the issue text.