Harden cluster bus packet framing

[roshkhatri]

Summary

Hardens cluster-bus packet framing and PING extensions independently of the variable payload validation tracked in valkey-io#3972.

Findings

• The initial cluster header allowed very large advertised packet lengths to be buffered before semantic validation, enabling memory exhaustion.
• Malformed extension lengths, padding, typed payloads, or unterminated strings could reach extension processing.
• Large locally generated extensions or gossip estimates could exceed the packet budget, abort the sender, or clear previously learned peer metadata when omitted.

Fix

• Enforce a symmetric 16 MiB total wire-packet limit before inbound buffering and outbound construction.
• Reject oversized PUBLISH, SPUBLISH, and module sends before allocation or local-only delivery.
• Validate extension alignment, remaining bytes, type-specific minimum sizes, and in-bounds NUL termination.
• Budget fixed headers and gossip before extensions; omit oversized extensions gracefully.
• Preserve peer metadata on capability-only zero-extension packets.
• Cap PFAIL/ordinary gossip counts and rate-limit omission warnings.

Compatibility

Peers that advertise packets larger than 16 MiB are rejected. New senders enforce the same limit and return explicit errors instead of generating packets receivers reject.

Scope

This PR intentionally excludes inbound PUBLISH, PUBLISHSHARD, and MODULE payload-consistency checks owned by valkey-io#3972.

Validation

• Full build passed.
• Cluster packet: 7 passed.
• Availability zone: 5 passed.
• Cluster Pub/Sub: 6 passed.
• Sharded Pub/Sub: 8 passed.
• Module cluster API: 30 passed.
• Module publish API: 4 passed.
• git diff --check and clang-format 18 source checks passed.

Draft in the fork for manual security and compatibility review.