fix(plugin): meter every host call and copied byte (#221)

Every plugin import now counts as a host call (reply_len, reply_read and set_output were free), and bytes copied out of or into the plugin's memory spend fuel, reserved before the copy or allocation, including when call overhead is set to zero. Fixes #192.

The log byte budget test from #216 runs with the default fuel, since copying a megabyte of log bytes is itself charged now.

docs/plugins.md

@@ -251,12 +251,17 @@ it can handle):
 
 Limits per run, and again per panel callback: 1,000,000,000 fuel (about a second or two of plain
 WebAssembly in a debug build, far less in a release build), 64 MB of memory, 100,000 host calls
-(each also costs 10,000 fuel), 16 MB per string either way, 1,000 log lines, and modules up to
+(each also costs 10,000 fuel, including `reply_len`, `reply_read` and `set_output`), 16 MB per string either way, 1,000 log lines, and modules up to
 16 MB. A panel spec is at most 64 KB with 64 controls; settings are at most 64 KB per plugin (keys
 and JSON values), keys 1–128 characters. A widget callback gets the same limits; its description is
 at most 4 MB with 256 layers nested 16 deep, its state at most 16 KB (keys 1–128 characters), and
 its images 1 MB each, 2 MB together and 4096 pixels on a side.
 
+Copying a byte across the guest-memory boundary costs one additional fuel, reserved before the
+allocation or copy. This also applies when the configured per-call overhead is zero. A reply
+read is charged for the bytes actually returned, not the requested buffer size. `calls` counts
+every ABI import, including calls which only query the reply length.
+
 ## ABI (version 3)
 
 Version 2 adds panels and settings to version 1, and version 3 adds widgets; a version 1 or 2