Validate nested iref reference sizes

[kixelated]

Split from #199. Refs #179.

What changed

• Validate each nested iref box size before slicing its body.
• Decode each reference only within its declared box body.
• Reject undersized, oversized, and trailing nested reference data with Error::InvalidSize.
• Add regression tests for lengths smaller than the header and larger than the enclosing body.

Why

Nested box lengths are attacker-controlled. The previous decoder subtracted and sliced them without bounds checks, which could underflow, panic, or decode across box boundaries.

Impact

Malformed iref data now returns a normal parse error while valid references continue to decode unchanged.

Validation

• cargo fmt --all -- --check
• cargo test --all-features (252 unit tests and 3 doctests passed)
• cargo clippy --all-targets --all-features -- -D warnings
• git diff --check main...HEAD