BUG/MINOR: connection: check the NetScaler CIP header length against received data

BUG/MINOR: connection: check the NetScaler CIP header length against received data

conn_recv_netscaler_cip() only checks that the announced header length
<hdr_len> is not larger than the whole peeked data, which includes the
8 (legacy) or 12 (standard) byte CIP prefix. The header is then consumed
with a single recv() of prefix + hdr_len bytes into the trash chunk. With
hdr_len close to tune.bufsize (e.g. 16384 with the default bufsize), this
recv() writes up to 12 bytes past the end of the trash buffer.

Make sure the announced header fits in the data received after the prefix
before going further.

CIP is only accepted from trusted peers, so this is not a security issue,
but a sender misbehaving that way must not corrupt memory.

This should be backported to all stable versions.