Tighten MQTT 3.1.1 packet validation

[VolkerChristian]

Motivation

• Bring SNode.C MQTT 3.1.1 wire-level validation closer to Mosquitto semantics for CONNECT/SUBSCRIBE/PUBLISH/fixed-header flags and Remaining Length handling.
• Reject malformed packets early to avoid protocol ambiguity and potential state corruption from silently-clamped values.
• Preserve existing Mosquitto-compatible private-bridge behavior and retain-as-published semantics for bridge clients while adding stricter validation.

Description

• Added server-side CONNECT validation to reject CONNECT variable-header reserved bit 0x01 while preserving protocol-level private-bridge bit (0x80) behavior and reflect/masking logic; files changed: src/iot/mqtt/server/Mqtt.cpp.
• Enforced SUBSCRIBE payload QoS/options validation so only 0x00|0x01|0x02 are accepted and invalid option bytes cause parse error; file changed: src/iot/mqtt/server/packets/Subscribe.cpp.
• Tightened PUBLISH validation to reject QoS 3, reject DUP=1 with QoS 0, require non-empty topic, require non-zero packet identifier for QoS>0, and avoid uint16_t truncation when sizing large payloads; file changed: src/iot/mqtt/server/packets/Publish.cpp.
• Hardened Remaining Length (UIntV) decoding to reject overlong encodings and continuation on the fourth byte; file changed: src/iot/mqtt/types/UIntV.cpp.
• Added unit-test target and comprehensive MQTT 3.1.1 validation test exercising CONNECT private-bridge and reserved-bit handling, SUBSCRIBE QoS/options validation, fixed-header flags checks (SUBSCRIBE/UNSUBSCRIBE/PUBREL), PUBLISH validation and large payload preservation, and Remaining Length error cases; new files: tests/unit/mqtt/Mqtt311PacketValidationTest.cpp and tests/unit/mqtt/CMakeLists.txt (and updated tests/unit/CMakeLists.txt).

Testing

• Built with tests enabled and ran the new test suite using cmake -S . -B build -DSNODEC_BUILD_TESTS=ON, built Mqtt311PacketValidationTest, and executed it under ctest, all assertions passed for the new validation cases.
• Ran a full build and executed ctest for Mqtt311PacketValidationTest and existing MqttMigration08Test, both passed (100% pass for those targets in CI run performed here).
• Tests added: Mqtt311PacketValidationTest (covers CONNECT private-bridge and reserved flag, SUBSCRIBE QoS validation, fixed-header flags, PUBLISH QoS/DUP/packet-id/topic/retain/large-payload, and Remaining Length malformed encodings), and CMake entries to run it as a unit test.
• Note: MQTTSuite mqttbridge sources were not present in the workspace, so end-to-end bridge republish verification against an external secondary broker was not run here; internal broker/packet paths and unit tests confirm private-bridge CONNECT masking and retain-bit preservation so retained-message propagation through mqttbridge remains a no-issue from the SNode.C side based on these tests and code paths.

---

Codex Task