docs: clarify 64 KiB response-body buffer in authz plugin docs

[matte1782]

What

Adds a new "Response body size and partial buffering" subsection to docs/extend/plugins_authorization.md documenting the 64 KiB maxBufferSize constant in the daemon's internal responseModifier (pkg/authorization/response.go in moby/moby) and its practical implications for plugins that use ResponseBody inspection.

Why

The existing docs (lines 81–87) tell plugin authors that streaming endpoints such as logs and events send only the HTTP request to authorization plugins, but don't explain the underlying mechanism. As a result, plugin authors building response-body redaction or content-filtering can be surprised when the same effect happens on non-listed endpoints whose response is produced through multiple writes that exceed the buffer, or whose handler uses io.WriteFlusher.

This is not a behavior change — the 64 KiB buffer is observable from the public moby source. The PR is documentation catching up to existing behavior.

How

• Inserts a new `###` subsection right after the existing "chunked HTTP response" paragraph (line 87 in `master`).
• 25 lines added, 0 removed.
• Uses the existing `> [!NOTE]` callout syntax (introduced to this file in `f1befab` on 2024-08-16).
• No content removed, no other section modified.

Who's affected

Plugin authors and operations teams running authorization plugins that depend on `ResponseBody` for security decisions on large or streaming responses. For redaction-style plugins, the new section recommends performing filtering in a separate layer in front of the daemon when the endpoint is likely to exceed 64 KiB or stream chunked output.

Verification

The numbers and behaviors described in the new subsection were derived directly from a read of `pkg/authorization/response.go` at moby `master`:

• `maxBufferSize = 64 * 1024` at `pkg/authorization/response.go` line 50.
• `responseModifier.Write` at line 117–128 calls `Flush()` when `len(rm.body) + len(b) > maxBufferSize`.
• `responseModifier.FlushAll` at line 167–197 writes the buffer to the underlying `http.ResponseWriter` and then drains the buffer slice.
• `pkg/ioutils/writeflusher.go` `WriteFlusher.Write` calls `Flush()` after every underlying write.
• `pkg/authorization/middleware.go` invokes `AuthZResponse` after the handler returns.