fix(rtp): add marshal-side bounds checks for CSRC count, extension lengths, and NALU sizes

[nightness]

Summary

• RTP header CSRC count: RFC 3550 §5.1 defines CC as a 4-bit field (max 15). Previously self.csrc.len() as u8 would silently truncate; now returns Error::TooManyCSRCs(n) if > 15.
• One-byte extension payload: RFC 8285 §4.2 requires 1–16 bytes. Previously payload.len() as u8 - 1 would wrap/truncate on 0-length or >16-byte payloads; now returns Error::OneByteHeaderExtensionPayloadTooLarge(n).
• Two-byte extension payload: RFC 8285 §4.3 max 255 bytes. Previously payload.len() as u8 silently truncated; now returns Error::TwoByteHeaderExtensionPayloadTooLarge(n).
• H.264 STAP-A NALU length: Aggregation length field is u16; oversized NALUs are now skipped rather than having their length field silently truncated.
• H.265 aggregation NALU length: Same fix — NALUs > 65535 bytes are skipped in the aggregation loop.

Parse-side already has bounds checks; this brings marshal-side to parity.

Test plan

• cargo test -p rtc-rtp — all 99 existing tests pass
• Manually verify Header::marshal_to() returns Err(TooManyCSRCs(16)) for a header with 16 CSRCs
• Verify one-byte extension rejects 0-byte and 17-byte payloads
• Verify two-byte extension rejects 256-byte payload

🤖 Generated with Claude Code