fix: add guest limits and rate limiting to booking-guests endpoint (#27494)

* fix: add guest limits and rate limiting to booking-guests endpoint

- Add ArrayMaxSize(10) validation to limit guests per request to 10
- Add aggressive rate limiting (5 requests/minute) via @Throttle decorator
- Add total guest limit check (max 30 guests per booking) to prevent abuse
- Update API documentation to reflect new limits

This prevents scammers from using the endpoint to send spam emails
to hundreds of guests through our system.

Co-Authored-By: morgan@cal.com <morgan@cal.com>

* docs: update openapi.json with guest limits and rate limiting info

Co-Authored-By: morgan@cal.com <morgan@cal.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

packages/platform/types/bookings/2024-08-13/inputs/add-guests.input.ts

@@ -4,6 +4,7 @@ import {
   IsArray,
   IsEmail,
   ArrayMinSize,
+  ArrayMaxSize,
   IsString,
   IsOptional,
   IsTimeZone,
@@ -67,12 +68,13 @@ class Guest {
 
 export class AddGuestsInput_2024_08_13 {
   @ArrayMinSize(1)
+  @ArrayMaxSize(10, { message: "Cannot add more than 10 guests at a time" })
   @IsArray()
   @ValidateNested({ each: true })
   @Type(() => Guest)
   @ApiProperty({
     type: [Guest],
-    description: "Array of guests to add to the booking",
+    description: "Array of guests to add to the booking. Maximum 10 guests per request.",
     example: [
       {
         email: "john.doe@example.com",