mavcaldav: name the shared response-body read cap (V-581)

fetchEvents and listPublished both bounded their HTTP body reads at
4<<20 with no name for what the number was for. One constant,
maxResponseBody, documents the reason (cap every CalDAV response this
daemon reads) once instead of twice. No functional change.

cmd/mavcaldav/main.go

@@ -188,6 +188,11 @@ func (p *poller) pollOnce(ctx context.Context) {
 	}
 }
 
+// maxResponseBody bounds every CalDAV response this daemon reads (the poller's
+// GET and the renderer's PROPFIND) — a misbehaving or malicious server gets a
+// truncated read, not an unbounded one.
+const maxResponseBody = 4 << 20
+
 // fetchEvents GETs the calendar URL and parses VEVENTs from the iCal response.
 func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Event, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.url, nil)
@@ -203,7 +208,7 @@ func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Eve
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
 	if err != nil {
 		return nil, err
 	}

cmd/mavcaldav/render.go

@@ -142,7 +142,7 @@ func (r *renderer) listPublished(ctx context.Context) ([]int64, error) {
 		return nil, err
 	}
 	defer resp.Body.Close()
-	raw, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	raw, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
 	if err != nil {
 		return nil, err
 	}