Add Input Length Limit guardrail plugin against DoW attacks

[Tracker]
Update Summary: [One-line status update for stakeholders]
Short Description: Add Input Length Limit guardrail plugin
Check-in Date: MM/DD/YYYY
[/Tracker]

Problem/Motivation

There is currently no guardrail to limit the length of user input sent to AI providers. Excessively long inputs can be used for context stuffing attacks, denial-of-wallet attacks (consuming expensive API tokens), or to overwhelm the AI model's context window.

A simple input length limit guardrail would provide a configurable safety net that blocks requests exceeding a character or token count before they reach the provider API.

Proposed resolution

• Create a new InputLengthLimit guardrail plugin that implements processInput().
• Allow configuring a maximum length in characters, with an option to use the ai.tokenizer service for token-based counting instead.
• The limit should apply to the last user message by default, with a configurable option to apply to the total conversation length (all messages combined).
• Return a StopResult when the input exceeds the limit, with a configurable violation message.
• Add tests covering both character-based and token-based limits.

AI usage (if applicable)

[x] AI Assisted Issue
This issue was generated with AI assistance, but was reviewed and refined by the creator.

[ ] AI Assisted Code
[x] AI Generated Code
[ ] Vibe Coded

- This issue was created with the help of AI