safety: speed mismatches should make rx go invalid

Instead it just sets controls_allowed to false

note that Tesla compares a signed speed with an unsigned speed currently

Start by tracing where speed mismatches are handled and how the receive path marks messages invalid. Compare the current signed-versus-unsigned speed behavior noted for Tesla. Done means a speed mismatch invalidates rx, rather than only setting controls_allowed to false.

Written by the indexing model from the issue text.