Tenderlink: Guard BFT packet allocations

[endophysics]

Add defensive bounds around BFT packet handling to reduce OOM risk during malformed traffic or congestion.

Overview:

• Caps transport jumbogram reassembly at the existing 8 MiB MAX_JUMBOGRAM_LEN before resizing buffers.
• Uses checked offset arithmetic to avoid overflow in fragment reassembly.
• Drops invalid/oversized fragment senders instead of panicking on retry failure.
• Adds an 8 MiB BFT proposal size cap.
• Rejects oversized, overflowing, or out-of-range proposal chunks before allocation.
• Re-checks proposal bounds after signature verification before mutating BFT round state.
• Fixes rounds_data pruning so decided historical rounds are not retained twice after being copied into recent_commit_round_cache.