fix: panic on Initial packets with a zero-length DCID (#5) (#533)

• fix: panic on Initial packets with a zero-length DCID

A remote unauthenticated attacker can crash a QUIC server with only two packets:

1. Send an Initial packet with a zero-length DCID and a garbage token, which triggers the server to issue a Retry token embedding the zero-length DCID as the odcid.
2. Replay the poisoned Retry token; the decoded odcid is restored to None, and the server panics on token.odcid.unwrap().

This patch applies defense in depth:

• endpoint: drop the first Initial packet with a DCID shorter than 8 bytes, as required by RFC 9000 Section 7.2. The DCID of a subsequent Initial packet carrying a valid Retry token is not affected.
• endpoint: replace token.odcid.unwrap() with explicit error handling.
• token: reject encoding/decoding Retry tokens whose odcid is shorter than 8 bytes, as required by RFC 9000 Section 8.1.2.1.
• tests: fix missing assertions in address_token tests and add regression tests for the poisoned tokens.

• ci: fix static analysis and unit testing workflows

• Pin typos-cli to 1.42.3: the latest release (1.50.3) requires rustc 1.95, which is newer than the toolchain pinned in this repository (1.90.0). 1.42.3 is the newest release whose MSRV (1.87) is compatible.
• Skip the Codecov upload step when no CODECOV_TOKEN is available (e.g. on forks, which do not inherit upstream secrets), instead of failing the whole unit testing job.

• fixup: correct RFC reference and drop unused import

• Remove the unused MAX_CID_LEN import in token.rs.
• Correct the RFC 9000 reference: Retry tokens are described in Section 8.1.2 (Address Validation Using Retry Packets); there is no Section 8.1.2.1.