swarm-controller: refuse a cap systemd would ignore; GET creates no bucket

systemd ignores a CPUQuota= or MemoryMax= it can't parse ("Invalid ...,
ignoring") and runs the unit without that limit. A swarm cap replaces
the hive's answer, so such a value left the agent uncapped while the
route, GET and the dashboard all said it was capped. argus on #4268 (R3)
found values the route took that systemd ignores: 12.345%, 400.123%,
0.001%, 17000000T, 99999999999999999999T and 99999999999999999999%.

The validators now accept a subset of what systemd parses, measured
against `systemd-analyze verify` (systemd 260):

- a percentage takes at most two decimals and is above zero, up to 100%
  for memory_max and 21474836.47% for cpu_quota (systemd keeps the quota
  in hundredths of a percent in a C int, not a u64)
- a size is one parse_size term: digits, an optional fraction, then
  nothing, B, K, M, G or T, case-sensitive. The whole part and the
  fraction digits fit u64, the whole part (plus one with a fraction)
  fits u64 once scaled, and the byte count is at least 1 and below
  2^64 - 1, as systemd checks them.

P and E, which systemd reads, stay refused because hive-c0re's validator
refuses them, and one value the hive refuses stops every cap update on
that hive. Values are stored as given: lower-case suffixes and a B
after a multiplier are refused rather than normalized, as systemd
refuses them.

The newline-injection values from the hive's test are in both bad lists
and go through the router in a_cap_with_a_second_line_is_a_400_and_the_caps_stay.

GET reads through a new agent_limits::open that returns None for a
missing bucket, answered as {}, instead of creating the bucket.

docs/scheduler/coordinator.md

@@ -491,9 +491,13 @@ caps. swarm-controller alone writes it:
 | `PUT`    | `/api/agents/<agent>/limits` | `{"cpu_quota": "400%", "memory_max": "8G"}`, every field optional, replacing the stored value |
 | `DELETE` | `/api/agents/<agent>/limits` | —; answers 204                                                                                |
 
-`PUT` refuses an agent no hive's wanted state declares, unknown fields, zero
-and anything systemd doesn't take, and stores memory the way systemd spells
-it (`8gb` as `8G`).
+`PUT` refuses an agent no hive's wanted state declares, unknown fields, and
+any value systemd would ignore, which would leave the agent uncapped. A
+percentage has at most two decimals and is above zero, up to `100%` for
+`memory_max` and `21474836.47%` for `cpu_quota`. A size is digits with an
+optional fraction and an optional `B`, `K`, `M`, `G` or `T` (upper case), at
+least one byte and below 2^64 - 1 bytes. The controller stores each value as
+given.
 
 Every 30 seconds hive-c0re (`workers::swarm_limits`) reads the key of each
 agent it has and stores the result in `meta/swarm-resource-limits.json`. Each