Abuse mitigation: Limit number of reviewers
We currently do not have a validation on the max number of reviewers or assignees.
It is hard to think of a valid scenario in which an issue or merge request could reasonably have more than a handful of individual reviewers, so I propose we set a new cap on this, set at a conservative value (100?) and aim to bring it down into the range of 20-50.
This would mitigate abuse vectors (spamming users by mass-assigning them).