Check padding size

[reynir]

Neither in unpad or before calling unpad we check that the length is at least one from the offset before reading the last byte.

miragevpn/src/engine.ml

Lines 1394 to 1403 in 8d70130

	let* () =
	guard
	(String.length dec >= hdr_len)
	(`Payload_too_short (hdr_len, String.length dec))
	in
	(* TODO validate replay packet id and ordering *)
	Log.debug (fun m ->
	m "received replay packet id is %lu" (String.get_int32_be dec 0));
	(* TODO validate ts if provided (avoid replay) *)
	unpad AES.CBC.block_size dec hdr_len

Previous discussion: #279 (comment)