Cap TLS record length to RFC 8446 limit in ClientHello peeking

[mmatur]

What does this PR do?

• Validate recLen against the RFC 8446 Section 5.1 maximum (16,384 bytes) before allocating the bufio.Reader in clientHelloInfo
• Reject TLS records advertising a payload length exceeding this limit, preventing oversized per-connection buffer allocations

Motivation

A malicious client can send a crafted TLS record header with an inflated length field (up to 0xFFFF) and then stall, forcing Traefik to allocate an oversized buffer (~65 KiB instead of ~4 KiB) per connection. With enough concurrent connections against a memory-constrained instance, this can cause
resource strain. Capping at the RFC-mandated bound eliminates this amplification vector.

More

• Added/updated tests
• [ ] Added/updated documentation

Additional Notes

[juliens]

LGTM

[rtribotte]

LGTM