gitea forge bundle: name the parent the forge used, match protection rules as the forge does, bound a commit's size and a search's time (issue 539)

The forge's contents and diffpatch endpoints take a branch, never a commit to
build on, so the parent is read from the commit the forge made, and a branch
that moved under the commit is said. Blobs are read at the commit read first,
not at the branch name. Protection rules match as Gitea 1.27 matches them
([...], {a,b}, escapes, a plain name in any case), in the Go bundle and in
guard.ts alike. One commit carries at most 4 MiB per file or patch and 16 MiB
together; code search stops at its deadline and says so. The HTTP client the
two Go bundles copied is one package, internal/forgehttp.

modules/gitea/cmd/forge/main.go

@@ -53,7 +53,9 @@ func Tools(forge func() (*Forge, error)) []stdio.Tool {
 				"independent review approved and whose required checks passed (gitea_merge_pull_request). Carries " +
 				"either files — each {path, content (text) | content_base64 | delete: true}, created or updated as " +
 				"the branch holds them — or patch, a unified diff as git diff writes it, which the forge applies. " +
-				"Answers the commit it made and its parent, read back from the branch. Replaces git commit and git " +
+				"At most 200 files, 4 MiB each and 16 MiB together, or a 4 MiB patch. Answers the commit it made and " +
+				"the parent the forge made it on, read back from the branch, and says when the branch moved under " +
+				"it. Replaces git commit and git " +
 				"push of a feature branch. (a)",
 			Input: map[string]any{
 				"type": "object",