SECURITY: Impose a upper bound on limit params in various controllers

What is the problem here?

In multiple controllers, we are accepting a `limit` params but do not
impose any upper bound on the values being accepted. Without an upper
bound, we may be allowing arbituary users from generating DB queries
which may end up exhausing the resources on the server.

What is the fix here?

A new `fetch_limit_from_params` helper method is introduced in
`ApplicationController` that can be used by controller actions to safely
get the limit from the params as a default limit and maximum limit has
to be set. When an invalid limit params is encountered, the server will
respond with the 400 response code.

spec/requests/admin/reports_controller_spec.rb

@@ -30,6 +30,12 @@ RSpec.describe Admin::ReportsController do
       end
 
       context "with invalid params" do
+        context "when limit param is invalid" do
+          include_examples "invalid limit params",
+                           "/admin/reports/topics.json",
+                           described_class::REPORTS_LIMIT
+        end
+
         context "with nonexistent report" do
           it "returns not found reports" do
             get "/admin/reports/bulk.json",
@@ -154,6 +160,12 @@ RSpec.describe Admin::ReportsController do
             expect(response.parsed_body["report"]["total"]).to eq(1)
           end
         end
+
+        context "when limit param is invalid" do
+          include_examples "invalid limit params",
+                           "/admin/reports/topics.json",
+                           described_class::REPORTS_LIMIT
+        end
       end
 
       describe "when report is scoped to a category" do