[PATCH] http2: bound number of http2 frames per tx

[PATCH] http2: bound number of http2 frames per tx

Ticket: 8289

If stream.reassembly.depth is unlimited,
an attacker controlling the 2 sides of a communication going through Suricata
can send a transition with an infinite number of headers, until suricata OOMs

Solution is to offer a configuration option to bound the number
of HTTP2 frames we store in a HTTP2 transaction, and produce an
anomaly if this bound is crossed

(cherry picked from commit 784e173278944c3596ea9cb219afcfafece6d156)

Origin: upstream, https://github.com/OISF/suricata/commit/82b7c9c35aaebf8a2811bdb703dd51c2fa0693c2.patch
Bug: https://redmine.openinfosecfoundation.org/issues/8296
Subject: Upstream fix for CVE-2026-31935

Gbp-Pq: Name CVE-2026-31935.patch