feat(transport): place request size limit for JSON

To not deserialize over-sized requests with content body,
we also need transport-specific size restrictions.  They are
come before input validation, and are also configurable.

Change-Id: I06434431b3df9250c05472b4d91a53dfedb682d2