Bound the MTOM, SwA and SOAP bodies too

The ceilings added for the form builders left the other stream-reading builders
unbounded, which bounds nothing: the caller picks the builder by choosing the
Content-Type, so sending multipart/related avoided them entirely. Bound the
whole multipart body in MIMEBuilder, before the parts are buffered to heap or
disk, and a plain SOAP or POX body in SOAPBuilder. Its MIME path takes its root
part from the now-bounded multipart body and needs no ceiling of its own. Item
10 of the threat model scoped itself to the form builders, which is what let
this stand; it now says every stream-reading builder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>