artifact: protect against unbounded artifact decompression (1.4.x)

[shoenig]

This PR enables mitigation provided by go-getter against payloads which decompress into an unbounded size. Nomad Client now exposes two new fields in the artifact block,

artifact.decompression_size_limit (e.g. "10GB") - the maximum amount of
data that will be decompressed before triggering an error and cancelling
the operation

artifact.decompression_file_count_limit (e.g. 1024) - the maximum number
of files that will be decompressed before triggering ana error and
cancelling the operation.

Note that for the 1.4.x, 1.3.x and 1.2.x these values are left unset, meaning no
limit will be applied. Operators will need to opt-in to the mitigation if they choose
to do so.

In Nomad 1.5 these limits will start defaulting to some value (which may be a breaking
change for some users).

Targets: release/1.4.x, Backport to 1.3.x and 1.2.x

(not main, which changed all of this code and will get its own PR)

[shoenig]

Spot check

nomad.hcl

server {
  enabled = true
}

client {
  enabled = true
  artifact {
    decompression_size_limit = "1M"
    decompression_file_count_limit = 1024
  }
}

bomb.nomad

job "bomb" {
  datacenters = ["dc1"]

  group "group" {
    task "task" {
      driver = "exec"

      artifact {
        source = "https://github.com/hashicorp/go-getter/raw/main/testdata/decompress-zip/bomb.zip"
        destination = "local/"
      }

      config {
        command = "/bin/sleep"
        args = ["infinity"]
      }

      resources {
        cpu    = 100
        memory = 256
      }
    }
  }
}

agent logs

    2023-02-10T19:15:39.292Z [ERROR] client.alloc_runner.task_runner: prestart failed: alloc_id=1ec4a313-aa89-aef2-3b18-efd60a21f6e0 task=task error="prestart hook \"artifacts\" failed: failed to download artifact \"https://github.com/hashicorp/go-getter/raw/main/testdata/decompress-zip/bomb.zip\": zip archive contains too many files: 65534 > 1024"

no count limit

client {
  enabled = true
  artifact {
    decompression_size_limit = "1M"
    decompression_file_count_limit = 0
  }
}

agent logs

    2023-02-10T19:19:33.560Z [ERROR] client.alloc_runner.task_runner: prestart failed: alloc_id=dcfa7246-9e18-d510-c1d1-d52d33528d81 task=task error="prestart hook \"artifacts\" failed: failed to download artifact \"https://github.com/hashicorp/go-getter/raw/main/testdata/decompress-zip/bomb.zip\": zip archive larger than limit: 1000000"

[shoenig]

Will switch to v1.7.0 once the tag exists

[tgross]

LGTM