ir/container: Check quantitative policy limits of created containers

Follow nspcc-dev/neofs-api#307. Containers
beyond the limits will not be approved from now.

Closes #3075.

Signed-off-by: Leonard Lyubich <leonard@morphbits.io>

CHANGELOG.md

@@ -39,6 +39,7 @@ Changelog for NeoFS Node
 - More efficient block header subscription is used now instead of block-based one (#3163)
 - `ObjectService.GetRange(Hash)` ops now handle zero ranges as full payload (#3071)
 - Add some GAS to system fee of notary transactions (#3176)
+- IR now applies sane limits to containers' storage policies recently added to the protocol (#3075)
 
 ### Removed
 - Drop creating new eacl tables with public keys (#3096)

pkg/innerring/processors/container/process_container.go

@@ -106,6 +106,10 @@ func (cp *Processor) checkPutContainer(ctx *putContainerContext) error {
 		return fmt.Errorf("auth container creation: %w", err)
 	}
 
+	if err = ctx.cnr.PlacementPolicy().Verify(); err != nil {
+		return fmt.Errorf("invalid storage policy: %w", err)
+	}
+
 	// check homomorphic hashing setting
 	err = checkHomomorphicHashing(cp.netState, ctx.cnr)
 	if err != nil {