fix(core): Limit valid avatar sizes

[provokateurin]

Summary

The code already limits the sizes to 64 and 512, so it can be properly documented for the API too.
The change from string to int in the GuestAvatarController is not a breaking change because the parameters is part of the path and thus always serialized the same regardless if it is a string or an int.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)