A persistent application limit rule. Instances whose executable basename is
in match_exe are placed into a shared app-<name> cgroup with these limits.
Limits are stored inline (a snapshot), not as a reference to a profile.
A process is protected if its full executable basename is in set, or,
when the executable is unreadable, if its comm is. comm is truncated to 15
characters by the kernel, so it only matches short names.
Parse a byte size: optional decimal fraction, optional unit K/M/G/T with
an optional “B” or “iB” suffix, case-insensitive, all binary multiples.
A bare number is bytes.