Coverity CID 910531/910532: bound decrypted seed length and clamp packet parse offset

[dgarske]

Fixes Coverity CID 910531 (OVERRUN) and CID 910532 (TAINTED_SCALAR).

• 910531: FwDecryptSeed() now fails closed if a decrypted seed exceeds the caller's buffer, bounding saltSize in FwCmd_StartAuthSession() (covers all four seed-decrypt callers).
• 910532: TPM2_Packet_ParseBytes() clamps pos to size on a truncated read so a tainted length can't run the parse offset past the buffer.