worker: add per-worker memory limit via RLIMIT_DATA

Introduce a per-worker heap cap as defense-in-depth against
memory-exhaustion DoS attacks. The limit uses RLIMIT_DATA rather
than RLIMIT_AS: since Linux 4.7 RLIMIT_DATA covers brk and private
anonymous mmap regions, i.e, the paths used by malloc and talloc, while
ignoring shared-library file mappings that inflate RLIMIT_AS without
reflecting actual allocation.

This aligns with haproxy's handling. See also:
https://github.com/torvalds/linux/commit/84638335900f1995495838fe1bd4870c43ec1f67
https://sources.debian.org/src/haproxy/3.2.17-1/src/limits.c?hl=486#L486
https://www.kernel.org/doc/html/latest/mm/overcommit-accounting.html

The cap is computed at worker startup by reading the data+stack field
from /proc/self/statm.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

doc/sample.config

@@ -215,6 +215,14 @@ ca-cert = ../tests/certs/ca.pem
 # [scope: global]
 isolate-workers = true
 
+# Apply a per-worker heap cap (RLIMIT_DATA) as defense-in-depth against
+# memory-exhaustion attacks. The limit is computed at worker startup as
+# the observed data-segment baseline plus 64 MB headroom. Enabled by
+# default; set to false only if the deduced cap proves too tight on your
+# system. This option is global and cannot be set at vhost level.
+# [scope: global]
+#limit-worker-memory = true
+
 # A banner to be displayed on clients after connection
 # [scope: vhost]
 #banner = "Welcome"