Limit lockfile download size

[colindean]

It's possible that a very large lockfile, valid or invalid, could be used as in a DoS. Limit the lockfile size, and expose an option to adjust the limit.

[colindean]

https://docs.python-requests.org/en/latest/user/advanced/#body-content-workflow

E.g.

content_length = int(response.headers['content-length'])
if content_length > LOCKFILE_DOWNLOAD_SIZE_LIMIT:
  raise LockfileTooLarge(content_length, LOCKFILE_DOWNLOAD_SIZE_LIMIT)