CVE-2026-84382: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

When decoding a compressed response body (gzip, deflate, br, or zstd), HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the response to keep memory usage bounded.