fix(vsock): packet/credit/dump validation from security audit

[MichalTarnacki]

#	Assessed Severity	Bug	Call Chain / Location	Fix	Classification	Disposition Reason
1	Medium	vsock Packet::check validates header len but not data_len vs buffer	-> check	In check(), require HEADER_LEN+data_len()<=buf.len(); return Err otherwise.	true_positive
2	Low	vsock credit counters rx_cnt/tx_cnt unchecked u32 add (wrap)	-> recv_packet_connected	Use wrapping_add intentionally per virtio-vsock spec, but move rx_cnt update AFTER data_len<=recv.len() check.	true_positive
3	Low	Slice index panic on VMM-controlled response length: Response::new() (vmcall.rs:		Review the finding context and add appropriate input validation or guard checks.	weakness	The reply.data()[0], reply.data()[1], and reply.data()[4..12] accesses can panic if the VMM returns a response with length == 24 (valid per Response::new() but leaving data() empty). The impact is exclusively a panic (DoS). The response buffer resides in shared memory fully controlled by the VMM, which already has unlimited DoS capability over MigTD through scheduling denial, VMCALL non-response, or simply returning VMCALL_STATUS_RESERVED indefinitely.

[sgrams]

Can you please rebase this PR?

[MichalTarnacki]

rebased