fix(api): hide jetty internals in oversized request 413 response

[bladehan1]

What does this PR do?

Installs a custom Jetty ErrorHandler (private OversizedRequestErrorHandler in HttpService) so that for an oversized request — the 413 thrown by SizeLimitHandler during dispatch — the node logs the detail server-side and returns the short, uniform bad-message page. Previously the default Jetty error page exposed the full exception stack, the Jetty version and the internal request size in the 413 response body.

The handler special-cases 413 only; all other errors fall through to super (Jetty's default handling).

Why are these changes required?

The 413 response body leaked Jetty internals (CWE-209 information disclosure / server fingerprinting): exact Jetty version, internal class names and line numbers, thread-pool internals, the JDK build, and the rejected request size, e.g.:

org.eclipse.jetty.http.BadMessageException: 413: Request body is too large: 664657339>4194304
    at org.eclipse.jetty.server.handler.SizeLimitHandler.checkRequestLimit(SizeLimitHandler.java:63)
    ...
    at java.lang.Thread.run(Thread.java:750)

Only the 413 path is affected, because SizeLimitHandler throws during dispatch (Server.handle) and is rendered via ErrorHandler.handle() -> writeErrorPageStacks. Parser-stage errors (400 / 414 / 431) already render via badMessageError() without a stack, so they are intentionally left untouched.

This PR has been tested by:

• Unit Tests
  • SizeLimitHandlerTest#testHttpBodyExceedsLimit: 413 body renders the short bad-message page and leaks no Jetty stack / class / size.
  • SizeLimitHandlerTest#testBadContentLengthReturnsDefault400, testOversizedUriReturnsDefault414: other 4xx stay on Jetty's default path (not rerouted through the 413 branch).
• Manual Testing
  • curl with an oversized body returns 413 with the short page; the response no longer contains the exception stack, class name or internal size.

Follow up

Extra details

Jetty 9.4.58. The fix lives in the base class HttpService#initServer() so it applies to every HTTP service (FullNode HTTP, Solidity, PBFT, JSON-RPC). The reason returned to the client is the generic HttpStatus.getMessage(413) ("Payload Too Large"); the full detail (including the rejected size) is kept only in the server log.