Feat: Maximum response size for Client Metadata Documents

[ThisIsMissEm]

I did some research through other OAuth related specifications and couldn't find any similar language. I'm unsure if we should set an absolute maximum, but I think a recommendation of 5 kilobytes is probably sufficient for almost all use cases.

I think typically these documents are under 1kb in size.

Resolves #9

[ThisIsMissEm]

One thing that may drive up the size of a client metadata document is full localisation of localisable properties in the document, given that the IANA language subtag registry includes several thousand languages: https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry

So maybe this limitation would actually be problematic, and we should just suggest something less than X megabytes, instead of kilobytes?

Although, I don't think I've ever seen localisation used in practice.

[aaronpk]

The other option for localization is to use a different client ID per language, https://example.com/id/en https://example.com/id/de etc.

This is good enough for now , we can always change it later if we get more feedback.