use limit reader to read event message

[bluebrown]

We should use something like https://pkg.go.dev/net/http#MaxBytesReader to make sure we dont read arbitrary large request bodies, making it harder to perform a DDOS attack on kobold.