net_packet_capture: read_at over-reads past segment boundary in PCAP capture

In net_packet_capture, both the RX and TX capture paths compute a copy_length to limit how many bytes to capture from each segment, but then pass an unbounded slice to read_at:

let copy_length = std::cmp::min(buf.len() - len, segment.len as usize);
let _ = pool.guest_memory().read_at(segment.gpa, &mut buf[len..]);
//                                                 ^^^^^^^^^ should be &mut buf[len..len + copy_length]

This reads buf.len() - len bytes from guest memory starting at segment.gpa, which can extend past the segment boundary into unrelated guest memory. The PCAP output happens to use the correct length (since len only advances by copy_length), but:

• Bytes beyond the segment are read into the capture buffer unnecessarily.
• If the over-read crosses into unmapped guest memory, read_at fails and the let _ = silently swallows the error, leaving stale/zero bytes in the buffer.

Fix: Change both sites to &mut buf[len..len + copy_length].

Affected code: vm/devices/net/net_packet_capture/src/lib.rs — the rx_poll capture loop and the tx_avail capture loop.