Oversized-data protection, normalize receive-timeout exceptions

The former is mainly for when you're receiving json data -- don't want
"this is a very very very ... very very very ... very long string"
to OOM, so add a (semi-)optional limit to the amount of data the
http client will receive without acknowledgement.

The latter is preventing the SocketTimeoutException implementation
detail from leaking