tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

An unbounded memory accumulation decompression bomb in tornado.curlhttpclient.CurlAsyncHTTPClient — the client-side sibling gap of CVE-2026-49855 — verified end-to-end on the 2026-08-15 master snapshot 6.6.dev1 and present unchanged in the latest release tag v6.5.8 and on master checked 2026-08-1...