[issue2551315] Allow admin settable max number of rows to be returned by rest interface

New submission from John Rouillard:

First step to handling:

 https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/

If the user requests @page_size > limit, interpret as though the limit has been
used.

OWASP includes cpu use, memory use etc. Some of these can be handled by ulimit settings
when running under gnuicorn or uwsgi. When running in a container similar memory and cpu
limits can be set.

Note that there is no limit AFAIK on the number of rows that can be retrieved via the web
interface either.

----------
components: API, Web interface
messages: 7939
nosy: rouilj
severity: normal
status: new
title: Allow admin settable max number of rows to be returned by rest interface
type: behavior

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551315>
_________________________________________________