CVE-2017-13763: ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

The vulnerability stems from two key issues:

1. In MessageDecoder.java, the decode() method reads a 4-byte integer for payload length (contentLength) and allocates a buffer of that size without validation. This allows attackers to trigger massive memory allocations.
2. In NettyMessagingManager.java, the server bootstrap configuration during connection setup (startAcceptingConnections) does not implement message size limits via Netty's decoder configuration (like LengthFieldBasedFrameDecoder with maxFrameLength), leaving the system vulnerable to oversized payload attacks. The patch focuses on timeouts but doesn't address payload size validation in these critical paths, leaving the root cause unmitigated in the analyzed code changes.