Add size limiting to file read() for safety

It was recently found that poor coding practices allowed the reading of
arbitrary files due to a lack of input sanitisation. That particular
problem will be addressed in a subsequent commit, but as an additional
measure we'll read no more than 1MiB from the file that stores the URL.

This should mitigate problems in the event that unexpected files are
opened (eg. /dev/zero).
Security: sanitise input when accessing URL files

Addresses the fact that an attacker could use a URL like the following
to navigate the filesystem and read the first line of arbitrary files
readable by the user running the lzma daemon:

  http://lzma.so/?short=../../../../../etc/passwd
We now have MAX_URL_LEN, use it for new URLs as well