HPACK/QPACK Huffman output cap is checked after unbounded Array.Resize doubling (bounded, hardening)

QPACK: the `decodedLength > _maxHeadersLength` cap (QPackDecoder.cs:638) runs AFTER Huffman.Decode, which grows its output via `Array.Resize(ref dstArray, dst.Length*2)` (Huffman.cs:714,781). Input is pre-capped to _maxHeadersLength (32KB) so the transient is bounded (~256KB/field) and rejected — not a DoS. But the cap being downstream of the growth is a clean hardening target: pass _maxHeadersLength into the decode/resize path and stop growing (throw) as soon as the decoded length would exceed the cap. Same post-hoc ordering in the HPACK path (HPackDecoder.cs:600). Line numbers per HEAD; please confirm against the target branch.

Start by reading QPackDecoder.cs:638, HPackDecoder.cs:600, and the Huffman.Decode growth paths at Huffman.cs:714 and 781, confirming the line locations on the target branch. Trace how _maxHeadersLength reaches decoding and verify that both HPACK and QPACK reject output before an expansion would exceed the cap.

Written by the indexing model from the issue text.