Harden chain depth bounds and parser input validation

[ColtonWilley]

Early PR for review — tests still needed.

Summary

• Enforce MAX_CHAIN_DEPTH limits in OCSP chain processing (SendCertificateStatus, ProcessChainOCSPRequest), certificate loading (ProcessUserChain), and TLS 1.3 certificate sending (SendTls13Certificate). Add idx bounds checks to chain accessors in ssl.c.
• Harden SNI extension parser (TLSX_SNI_GetFromBuffer) with length validation preventing buffer overreads on malformed ClientHello. Require exact listLen == extLen - OPAQUE16_LEN match to prevent extension boundary misalignment.
• Fix off-by-one in TLSX_CSR_Free (<= to <) — csr->requests is a count, and a full-depth chain with leaf OCSP could push the free loop one past the request.ocsp[] array.
• Add remaining-buffer bounds checks to PKCS7 decoders: DecodeEnvelopedData and DecodeAuthEnvelopedData (encryptedContentSz, authTagSz), DecodeEncryptedData (two sites), SignedData null signature tag, and PwriKek_KeyUnWrap cekLen off-by-4.

Test plan

• Existing PKCS7 test suite passes (enveloped, auth-enveloped, encrypted, signed data)
• TLS 1.3 OCSP stapling tests pass with WOLFSSL_TLS_OCSP_MULTI
• SNI callback tests pass
• Chain depth at MAX_CHAIN_DEPTH accepted; MAX_CHAIN_DEPTH + 1 rejected with MAX_CHAIN_ERROR
• Fuzz/malformed input: truncated PKCS7 AuthEnvelopedData returns BUFFER_E instead of OOB read