dtls: defer replay commits until datagram parse succeeds

[zRedShift]

Summary

• defer DTLS 1.2 and DTLS 1.3 replay-window commits until the full datagram parses successfully
• keep datagram-local replay/sequence state so same-datagram duplicates and stale records are still rejected before the permanent replay update
• add DTLS 1.2 and DTLS 1.3 regressions for malformed trailing records, duplicate encrypted records, and same-datagram window shifts

Validation

• git diff --check upstream/main..HEAD
• cargo fmt --manifest-path ../Cargo.toml --check
• cargo test --manifest-path ../Cargo.toml --all-targets --features rcgen
• cargo clippy --manifest-path ../Cargo.toml --all-targets --features rcgen -- -D warnings

Review

• adversarial review found no branch-blocking findings
• residual same-record malformed handshake-tail parsing is tracked separately as DIMP-029

[algesten]

@zRedShift I'm not sure about this one. I don't think anything in the specs says that there needs to be an all-or-nothing handling of UDP packets. A packet with valid records first and then trailing garbage, could be partially handled.

It ties into the bigger question of is_transient() error that we started looking at in #126. It could be we should simply silently drop records when they don't parse correctly.