[mysqlnd] Fix OK packet message length buffer over-read - #23497

The OK packet message-length varint is read after the last bounds check,
so a length-encoded integer at the end of a packet can advance p past
header.size and even past the end of the 4096-byte command buffer. The
old MIN(net_len, buf_len - (p - begin)) clamp then underflows and passes
an unclamped attacker-controlled length to mnd_pestrndup(), reading heap
memory beyond both the packet and its allocation. Reject a message length
that extends past the payload, matching php_mysqlnd_auth_response_read()
from GHSA-h35g-vwh6-m678; an audit found no further readers using the
vulnerable buf_len clamp.