fix: bound DNS RDATA decoding

[ryanfowler]

Summary

• bound shared DNS RDATA decoding to each record RDLENGTH
• reuse the bounded decoder for wire DNS and DoH wire responses
• reject malformed/truncated MX, SRV, SOA, CNAME, NS, TXT, and related RDATA
• add adjacent-record regression coverage

Checks

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• targeted DNS wire and DoH tests