Abuse mitigation: Limit number of reviewers

We currently do not have a validation on the max number of reviewers or assignees.

It is hard to think of a valid scenario in which an issue or merge request could reasonably have more than a handful of individual reviewers, so I propose we set a new cap on this, set at a conservative value (100?) and aim to bring it down into the range of 20-50.

This would mitigate abuse vectors (spamming users by mass-assigning them).