bgp: improve handling of large variable-length capabilities

In general, encoders should be infallible since we are representing valid internal protocol state as a stream of bytes. Any invalid state (e.g. trying to stuff more things into a Message or field than can fit) should be handled well before the attempt to encode it.

For example, if the local configuration would result in a capability length greater than what can be encoded (for capabilities: 1-byte field containing the length in octets), then we should have handlers for splitting that state into multiple capabilities.

Similarly, if a local configuration would result in so many capabilities that an Open message would exceed the max encode-able size of an Open then we should inform the operator so they can take action to reduce the size of the config (or we could error it out before it becomes a problem).

Start by locating the BGP capability and Open-message encoders, then trace how variable-length capabilities and the maximum Open-message size are represented. Done should prevent encodable state from reaching an infallible encoder by splitting oversized capabilities and reporting configurations that exceed the Open-message limit.