Use fleet limits for EnrollDevice after #237 #255

Follow-up after #237 lands. The user-first enrollment change replaces BeginEnrollment/CompleteEnrollment with GetLoginConfiguration and EnrollDevice and adds some ad-hoc limits that #237 covers.

Remove duplicated limits

• Remove the 16 KiB CSR size check in FleetAgentService::enroll_device (crates/controller/src/service.rs). fix(controller): add limits to the fleet gRPC API #237's 64 KiB limit on requests without a device certificate rejects oversized requests before they are decoded.
• Remove the 32-permit enrollments semaphore in FleetAgentService. It duplicates fleetLimits.enrollmentInFlight.
• Remove the 64 KiB ID token length check in OidcProvider::authenticate_enrollment (crates/controller/src/oidc.rs). The transport limit covers it.

Adapt #237 to the new RPCs

• In the RPC classification, replace BeginEnrollment/CompleteEnrollment with GetLoginConfiguration/EnrollDevice.
• EnrollDevice uses the EnrollmentLimiter in-flight slot and waits for it (as CompleteEnrollment did), because the user has already signed in.
• Decide where the per-address rate limit applies. GetLoginConfiguration is read-only and does not call the IdP, so the rate limit probably belongs on EnrollDevice.
• Update the fix(controller): add limits to the fleet gRPC API #237 tests that call BeginEnrollment.

Optional

• Add a setting such as fleetLimits.enrollmentMessageBytes only if a deployment needs more than 64 KiB, for example IdPs that put many group claims in ID tokens.