Defend against zip bombs

A zip bomb is a specially crafted file which expands to take up large
amounts of CPU time, disk space or memory.

The most well-known example of this is the 42.zip which is a zip file
consisting of 42 kilobytes of compressed data, containing five layers of
nested zip files in sets of 16, each bottom layer archive containing a
4.3 gigabyte (4 294 967 295 bytes; ~ 3.99 GiB) file for a total of 4.5
petabytes (4 503 599 626 321 920 bytes; ~ 3.99 PiB) of uncompressed
data.

Since we allow upload of gzip-compressed requests, we should defend
against malicious attacks like that.

This change adds a SafeGzipDecompressor which can be configured with a
max buffer size to use, and thus limits the amount of memory that we
permit a single upload to use.

gzip bomb created by 

```
$ dd if=/dev/zero bs=1024 count=102400 | gzip > gzip-bomb.gz
```

That creates an empty file full of zeros, which is 100M uncompressed,
but compressed down to a 100K gzip file.
What are `self.buf` and `self.pos` for?