there is set of available rules you can use in validation:
https://api.cakephp.org/3.6/class-Cake.Validation.Validation.html
what you need are:
https://api.cakephp.org/3.6/class-Cake.Validation.Validation.html#_fileSize
https://api.cakephp.org/3.6/class-Cake.Validation.Validation.html#_mimeType