aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

An attacker opens a single HTTP/1.1 connection to the server and sends a slow handler request followed by a large number of pipelined requests. While the server processes the first request, the pipelined requests accumulate in an internal queue without any bound. By keeping one handler busy (e.g., with a slow endpoint), the attacker can cause the queue to grow unboundedly, consuming excessive memory on the server and potentially leading to a denial of service.

The patch introduces a configurable `MAX_MSG_QUEUE_SIZE` (default 32) in `aiohttp/web_protocol.py`. When the number of parsed-but-unhandled pipelined requests reaches this limit, `data_received()` calls `_pause_msg_queue_reading()`, which pauses the underlying transport. As the request handler drains messages in `start()`, it calls `parser.message_consumed()` to free a slot and, once the queue drops to the low-water mark (`MAX_MSG_QUEUE_SIZE // 2`), calls `_resume_msg_queue_reading()` to reparse buffered data and resume the transport. This bounds the per-connection memory a client can pin by pipelining behind a busy handler.