Security: Validate and bound pagination parameters in list resources

Problem/Motivation

List endpoints accept limit and offset style query parameters that flow into entity queries and Search API ranges. Without validation and an upper bound, a client can request an unbounded result set and exhaust memory, which is a denial-of-service vector.

Proposed resolution

• Cast and validate every pagination parameter, rejecting non-numeric and negative values with 400 responses.
• Enforce a configurable maximum page size with a conservative default.
• Return consistent pagination metadata (total, page, page size) in every list response.

Remaining tasks

Centralise validation in MyrestResourceList and apply it to all list resources.

User interface changes

New maximum page size setting.

API changes

Out-of-range requests now return 400 instead of a large payload.