Limit max size of subscription codec

[HaHaWTH]

Description

This PR adds a maximum size limit to the ServerboundDebugSubscriptionRequestPacket codec.

Debug subscription packets are known to be abused by hack clients, in local testing, one client was able to fully occupy at least one Netty IO thread on a high-end system without triggering Paper's packet limiter.

Fix

Requests containing more than 64 subscriptions are now rejected and disconnect the client with a DecoderException to avoid excessive CPU usage and memory alloc.

The max size should be changed once Mojang adds more subscriptions in DebugSubscriptions. (currently the total count of subscriptions is 16 tho)

[Euphillya]

I think we should set the value in the configuration settings and disable it by default

[HaHaWTH]

I think we should set the value in the configuration settings and disable it by default

Could you clarify when this limit would need to be disabled or changed? The current vanilla debug subscription count is 16, so 64 seems safe above the expected value while still preventing abusive decode sizes.

I am not sure Paper's global configuration is guaranteed to be loaded before this codec is initialized.

[Malfrador]

Given this is a debug feature, I believe having it limited by default is fine.

General making exploit fixes opt-in somewhat defeats their purpose imo

[Owen1212055]

Thank you for your PR! Yeah, this does not need to be configurable.

[HaHaWTH]

This seems to be patched by Mojang in 26.2, should this be backported to old versions?

[Potothingi]

Can a player without OP permissions exploit this? If so, why is this debug feature allowed for players without OP permissions?

[HaHaWTH]

Can a player without OP permissions exploit this? If so, why is this debug feature allowed for players without OP permissions?

This works on the netty level, permissions are not checked yet when decoding packets.