fb9a5ed

fix(rtc): Keep only fingerprints DTLS can verify, and bound what every section repeats

A remote description's session-level ICE values and fingerprints are
copied into each of its media sections, and the parse kept any
a=fingerprint value and any ICE value whatever its length. A description
within MAX_REMOTE_SDP could so hold and print back many times its size:
the sdp fuzz target's case (OSS-Fuzz issue 584491879), 214,826 bytes of
junk fingerprints across 26 sections, printed back as 4,461,425, past what
the parse then reads.

A fingerprint is kept where it is RFC 8122's: sha-256, sha-384, or
sha-512 (what dtls::fingerprints_match verifies with; it ignores any other
function) and exactly that function's octets in colon-separated hex; any
other is skipped, as a malformed attribute is. A section holding more
than MAX_FINGERPRINTS (8), the session's included, or a description of
more than MAX_MEDIA_SECTIONS (64) is refused, and an ICE ufrag, pwd, or
options value past MAX_ICE_VALUE (256, RFC 8839) is skipped. The fuzz
target asserts what is printed stays within twice MAX_REMOTE_SDP and
parses back wherever it is within it; the case prints 36,455 characters.
Tests cover the kept and skipped fingerprints (one fails with the length
check removed), the bounds, and a description at every bound printing
back within twice the read limit.