The state array in the gazebo_ros_bumper plugin seems to be an array of contacts for each timestamp. Thus, the 100 contact states are the contact states in the span of a period of time. Thus limit the max contacts will not solve this, if you are setting the max_contacts tag in link collision to 1 (for the box example below), there will only be one contact between two bodies.
In other words, having 2 contacts will resulted in 2 contact_positions and wreches in the http://docs.ros.org/en/api/gazebo_msgs/html/msg/ContactState.html
Back to question on why 100 contact states when you rostopic echo the contact msg. This seems because of this in the code, prevent the size from expanding indefinitely. Thus, regardless if you set the <sensor><update_rate> to a lower rate, the contact states (which are the contact states for multiple timestamps between each "echo") will be limited to 100.