fix(h3 ffi): validate raw slice pointer metadata

[codeandsolder]

Summary

Validate HTTP/3 C-FFI raw buffer/header pointer metadata before constructing Rust slices.

This is the HTTP/3 counterpart to #2790, kept separate so the transport and H3 surfaces remain independently reviewable.

Problems addressed

The H3 FFI currently constructs slices directly from caller-provided pointers and lengths. Invalid C metadata can therefore violate Rust slice preconditions before quiche gets a chance to return an error. Oversized body lengths also panic instead of using the FFI error channel.

Change

• add QUICHE_H3_ERR_INVALID_ARGUMENT = -21;
• validate null/alignment/size metadata before slice::from_raw_parts(_mut);
• preserve the valid C convention NULL + len == 0 by constructing an aligned empty slice;
• return the H3 invalid-argument code instead of panicking for oversized body buffers;
• validate the outer header array and each header name/value pair before creating HeaderRefs;
• propagate invalid header metadata through request/response/additional-header calls;
• apply the same checks to body recv/send and extensible-priority parsing.

Validation

Rebased directly onto current upstream master (3fc9bc1c). On Rust 1.98.1 with --features ffi:

• h3_header_slices_accept_null_zero_and_reject_bad_parts: pass
• oversized_h3_ffi_length_returns_invalid_argument: pass

Formatting with the repository's nightly rustfmt configuration and git diff --check are clean.