socks: reject zero-length GSSAPI/SSPI tokens from proxy

[gregkh]

A "broken" SOCKS5 proxy can send an invalid length of the encryption token, which could cause malloc(0) to be called, which is a "platform can do what it wants" potential problem.

Resolve this by explicitly checking the length and rejecting the invalid token before ever attempting to allocate any memory.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: Adds explicit validation to reject zero-length GSSAPI/SSPI tokens from SOCKS5 proxies.
Why: Avoids potential platform-dependent behavior from calling malloc(0) by failing the negotiation before allocating token buffers.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

[bagder]

Thanks!