git-grep: ensure bounded default for MatchesPerFile

Analogously to how it happens for MaxResultLimit.

The default of 20 is inspired by a well-known, commercial code
hosting platform.

Unbounded limits are risky because they expose Forgejo to a class
of DoS attacks where queries are crafted to take advantage of
missing bounds.

modules/git/grep.go

@@ -67,9 +67,8 @@ func GrepSearch(ctx context.Context, repo *Repository, search string, opts GrepO
 		"--null", "--break", "--heading", "--column",
 		"--fixed-strings", "--line-number", "--ignore-case", "--full-name")
 	cmd.AddOptionValues("--context", fmt.Sprint(opts.ContextLineNumber))
-	if opts.MatchesPerFile > 0 {
+	opts.MatchesPerFile = cmp.Or(opts.MatchesPerFile, 20)
 	cmd.AddOptionValues("--max-count", fmt.Sprint(opts.MatchesPerFile))
-	}
 	words := []string{search}
 	if opts.IsFuzzy {
 		words = strings.Fields(search)