docs: settle MAX_REQUEST_BYTES provenance (#573)

[Yatsuiii]

Summary

Records the maintainer decision from #573 in docs/spec/proxy-security.md.

1. Sets MAX_REQUEST_BYTES to 1_000_000 decimal.
2. Records DOS-001 issue HIGH: No request body size limit before JSON parsing — pre-auth OOM via oversized payload (INJECT-001/DOS-001) #147 as the provenance.
3. Documents the derived 500,000 byte string limit.
4. States that MAX_JSON_NESTING_DEPTH and MAX_PARSE_TIME_MS must be evaluated against the 1MB cap.
5. Keeps the 10MB value as a separate resource and denial of service design decision.

No runtime code changed.

Verification

The change is limited to docs/spec/proxy-security.md.

Closes #573.