Ok, searching for regex and "limiting string length" helped to find a regex pattern for checking if the length is in a set range.

And checking the length of the key only requires to split key and value, separated by a =.

These .htaccess lines work = a 403 is returned if ...

• the length-to-be-checked key is the 1st parameter
• only \w characters are in the key
• this key is 1 to 5 characters long

RewriteCond %{QUERY_STRING} ^(\w{1,5})=(.*)$ [NC]
RewriteRule .* - [F,L]