Limit upload size of images

[joelvdavies]

Images should have a maximum upload size to avoid misuse, should be configurable like it is for attachments.

• Reject image creation requests that pass a specific size
• The maximum size should be configurable with the same default as the front end (currently 50MB at the time of writing)
• We may also wish to consider adjusting the max_size used in the underlying SpooledTemporaryFile used via the UploadFile object if possible (see https://stackoverflow.com/questions/73442335/how-to-upload-a-large-file-%E2%89%A53gb-to-fastapi-backend) as depending on Generate and store image thumbnails #30 we may need the image to be fully in memory anyway and this should make the upload faster
• Will need a larger and smaller image for e2e tests, one above the limit and one below (or we could potentially use faker/mock the data some other way?)
• We need to ensure docker-ims is updated appropriately with the readme explaining these settings along with the one for the front end both of which should match the proxy config.

[VKTB]

I think there are two parts to this. The first one is about limiting the size of the images that can be uploaded to the server and the second one is about limiting the size of the images that can be uploaded to storage.

As we are using UploadFile, there is no way of knowing what the size of an image is until it is fully uploaded to the server. I had a look at the link above about SpooledTemporaryFile and also at a middleware library for limiting the content size but I am struggling to follow so I would rather avoid implementing/using a logic that I don't know how it works. A simple way to solve this when the app is running in production mode is to configure the limit in the reverse proxy and that would stop API consumers from not just uploading images above the limit to the server but to the storage too.

I will keep this open in case we find a nicer solution to deal with it within FastAPI in future.