Check inbound unprocessed packet sizes

There seem to be SSH-like servers on the internet that behave maliciously, with the intent of repelling malicious connections. They work by sending out an infinite version length or banner. I checked the recent code, but cannot find any length checks or tests. Although I doubt it's a common occurrence, I think it's best to add these checks with tests. I haven't determined a good maximum size yet, however. With some recommendations on that, I'll happily make a PR. I do think separate limits should exist for the pre/post KEX.

Start by tracing inbound SSH version or banner parsing and checking nearby tests; the issue does not name specific files or existing length checks. Confirm appropriate maximum sizes, including separate pre-KEX and post-KEX limits, then add tests demonstrating rejection of oversized or unbounded input.

Written by the indexing model from the issue text.