XAML server: bound Content-Length and header sizes in JsonRpcConnection

Follow-up from the PR #50 review (finding L1).

server/src/WinUiXaml.LanguageServer/Lsp/JsonRpcConnection.cs line 226 allocates new byte[contentLength] directly from the Content-Length header with no upper bound, and the header-reading loop has no cap on individual header-line length or total header size. A malformed or hostile Content-Length therefore turns into an unbounded allocation.

Additionally, when int.TryParse fails on the header value the code silently leaves contentLength at 0 rather than treating the frame as a protocol error, which makes malformed input hard to diagnose.

Severity is low in practice: the only client on this pipe is the extension host over stdio, so this is defense-in-depth rather than a reachable attack path.

Suggested work:

• Cap Content-Length at a sane maximum (a few MB) and fail the frame beyond that.
• Cap header-line and total-header size.
• Treat a Content-Length parse failure as an explicit protocol error instead of falling through with 0.