Read the expiry form value where the body is bounded (#43)

The pinned CI linter's gosec G120 flagged r.FormValue in
buildDatabaseTargetConfig because the MaxBytesReader guard lives
one function up in processTargetCreate, out of static-analysis
sight. Read the expiry alongside the other form values in
processTargetCreate and pass it down as a string, matching how
the http and slack config builders receive their URL.

internal/handlers/source_management.go

@@ -816,6 +816,7 @@ func (h *Handlers) processTargetCreate(
 	targetType := database.TargetType(r.FormValue("type"))
 	targetURL := r.FormValue("url")
 	maxRetriesStr := r.FormValue("max_retries")
+	expiry := r.FormValue("expiry")
 
 	if name == "" {
 		http.Error(
@@ -835,7 +836,7 @@ func (h *Handlers) processTargetCreate(
 	}
 
 	configJSON, err := h.buildTargetConfig(
-		w, r, targetType, targetURL,
+		w, r, targetType, targetURL, expiry,
 	)
 	if err != nil {
 		return
@@ -893,11 +894,13 @@ func parseNonNegativeInt(s string) int {
 }
 
 // buildTargetConfig builds the JSON config string for a target.
+// The expiry form value is read by the caller (which bounds the
+// request body) and applies to database targets only.
 func (h *Handlers) buildTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
 	targetType database.TargetType,
-	targetURL string,
+	targetURL, expiry string,
 ) (string, error) {
 	switch targetType {
 	case database.TargetTypeHTTP:
@@ -905,7 +908,7 @@ func (h *Handlers) buildTargetConfig(
 	case database.TargetTypeSlack:
 		return h.buildSlackTargetConfig(w, r, targetURL)
 	case database.TargetTypeDatabase:
-		return h.buildDatabaseTargetConfig(w, r)
+		return h.buildDatabaseTargetConfig(w, expiry)
 	case database.TargetTypeLog:
 		return "", nil
 	default:
@@ -1017,16 +1020,16 @@ func (h *Handlers) buildSlackTargetConfig(
 }
 
 // buildDatabaseTargetConfig builds config JSON for a database
-// (archive) target. The optional expiry form value is validated
-// here, at creation time, so an unparseable value is rejected
-// with a 400 instead of failing every subsequent delivery. An
-// empty expiry yields an empty config (the keep-forever
-// default).
+// (archive) target. The optional expiry (a form value read by
+// the caller, which bounds the request body) is validated here,
+// at creation time, so an unparseable value is rejected with a
+// 400 instead of failing every subsequent delivery. An empty
+// expiry yields an empty config (the keep-forever default).
 func (h *Handlers) buildDatabaseTargetConfig(
 	w http.ResponseWriter,
-	r *http.Request,
+	expiry string,
 ) (string, error) {
-	expiry := strings.TrimSpace(r.FormValue("expiry"))
+	expiry = strings.TrimSpace(expiry)
 	if expiry == "" {
 		return "", nil
 	}