fix(middleware): stop BodyLimit handing out more than the limit

[Rohilalala]

Fixes #3071.

limitedReader.Read passed the caller's buffer to the source untouched and only looked at the running total afterwards, and the refusal did not stick. io.Reader asks callers to process the n>0 bytes of a read before treating its error as fatal, so a caller following that advice kept getting real data on every call after the limit had already been passed.

With a 5 byte limit against a 50 byte body, reading the way the docs describe returned all 50.

Three changes, each of which the tests pin separately:

• The read is capped at one byte past the limit. That byte is all it takes to know the body is too large, and without the cap a 64 KiB read pulls 64 KiB off the wire to enforce a 5 byte limit.
• That byte is not handed to the caller, so the total delivered never exceeds LimitBytes.
• Once the limit is passed the reader stays refused and does not touch the source again.

Existing BodyLimit tests are unchanged and pass.