fix: cap HTTP response read to prevent OOM on ignored Range headers

[pipe1os]

Summary

Adds an explicit read limit to HTTP requests in huggingface.py to prevent potential Out-Of-Memory (OOM) crashes.

Motivation & Context

In huggingface.py, the HTTP request fetching remote headers assumes the server correctly honors the Range request and limits the payload. However, if a CDN or proxy ignores the Range header and responds with 200 OK, the response.read() call will blindly read the entire multi-gigabyte weight file into memory, causing an out-of-memory (OOM) crash. Adding an explicit read limit to the HTTP read prevents this vulnerability.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Refactoring (no functional changes, no api changes)
• Documentation update

Checklist

• My code follows the code style of this project.
• My commit messages follow the Conventional Commits format, are lowercase, imperative, and specific.
• I have updated the documentation accordingly (if applicable).
• I have added tests to cover my changes.
• All new and existing tests passed.