Motivation:

To mitigate against the "HTTP/2 Rapid Reset" attack, it is recommended
that HTTP/2 servers should close connections that exceed the concurrent
stream limit.

Reference:

- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://www.cve.org/CVERecord?id=CVE-2023-44487
- netty/netty@58f75f6#diff-82f568a075ff63e9727ce8622f3a2b1553099182edf1fd0b4f857226252b05adR47

Modifications:

- Add `ServerBuilder.http2MaxRestFramesPerWindow()` option
  `-Dcom.linecorp.armeria.defaultHttp2MaxResetFramesPerMinute<integer>`
  property to limit the maximum allowed RST frames.
  - If not set, 400 RST frames per minute are alllowed by default.
- Bump Netty version to 4.1.100 from 4.1.96

Result:

You can now protect your server against DDOS caused by RST floods.
```java
Server
  .builder()
  .http2MaxResetFramesPerWindow(100, 10)
  .build();
```

Co-authored-by: jrhee17 <guins_j@guins.org>

Co-authored-by: jrhee17 <guins_j@guins.org>

Co-authored-by: jrhee17 <guins_j@guins.org>