Fix security review findings

[rthellend]

• Conn.Read: reject zero-length handshake records with unexpected_message instead of panicking with an out-of-range index. Any client could trigger the panic after a successful ECH handshake because ECH configs are public. Also guard the same index in inspectWrite and use its record argument.
• processEncryptedClientHello: stop trial decryption after the first key that succeeds. Previously, a later key with the same config_id and cipher suite reused the advanced HPKE context, failed, and cleared the decrypted ClientHelloInner, silently rejecting ECH.
• NewConn: evaluate err when the deferred alert conversion runs, not when the defer statement executes. Alerts were never sent and the connection was never closed on error.
• Transport: update the NewTransport doc to reflect that plaintext HTTP is allowed unless RequireECH is set.
• dns: limit decoded names to 255 octets and labels to 63 octets (RFC 1035 3.1) to bound memory use from compression pointer chains.