feat(protocol): add bounded plaintext OCF resource reads

[Jason-Morcos]

Summary

• Add read_plaintext_ocf_resource() for one known absolute href and public request port.
• Reuse the source-bound GET/Block2 engine from advertised endpoint discovery instead of adding a second UDP implementation.
• Return an immutable result with the raw response code and body, Block2 metadata, attempt count, and fixed failure classification.

Why

Some Family Hub responses span multiple Block2 packets and can arrive from a different UDP source port than the request port. Callers that need /oic/d, /oic/res, or another public resource currently have to duplicate the token, source-pinning, continuation, and deadline logic already used by discovery.

The latest hardware results in #16 also show why the response code needs to remain visible: a reachable endpoint or completed handshake does not imply that every resource is authorized. A complete 4.xx or 5.xx response is therefore returned as a complete non-success read, with its body intact.

Behavior

• Validates the absolute href, query values, port, deadline, retries, and address family before opening a socket.
• Keeps one token across retries and Block2 continuations, uses a new MID for each NON request, and pins the first correlated response peer.
• ACKs only accepted correlated CON responses.
• Applies one deadline and the existing 32-block, 64-KiB, and datagram bounds.
• Leaves CBOR schema decoding, authentication, and authorization decisions to the caller.

This branch is directly on main after #48 and is independent of #49 and #50; it does not touch dtls_session.py.

Validation

• 67 focused discovery/resource-read tests
• 492 full tests on Python 3.14
• 492 full tests on Python 3.11 with the dependency floor
• wheel/sdist content checks and isolated import tests
• share-safety check

Related: #16