Fix keytab parser panics and signed record-length framing (#1)

[p0dalirius]

Linked Issue

Closes #1

Root Cause

The record-parsing read path made two flawed assumptions. First, it trusted the input to be well-formed: every fixed-offset index (data[0:4], data[0:2], data[0]) and every variable-length slice (data[:c.Length], data[:k.Size]) ran without checking that enough bytes remained, and the error returned by each sub-parser was discarded. Second, it misread the record framing: the per-record length, which the keytab format defines as a signed 32-bit value, was read as uint32, and the next-record offset was computed from the bytes the entry fields happened to consume (data[entry.RawBytesSize:]) instead of from the record length. A negative length (a zero-filled hole) therefore became a huge unsigned size and triggered a slice-bounds panic, and any padding between the parsed fields and the record boundary desynchronized parsing.

Fix Description

• CountedOctetString.FromBytes, KeyBlock.FromBytes, and KeytabEntry.FromBytes now validate len(data) before each read and return a descriptive error instead of panicking, and they propagate the errors returned by the sub-parsers they call.
• Keytab.FromBytes reads the per-record length as a signed int32 and interprets it per the file format: a positive value is a record of that size, a negative value is a zero-filled hole that is skipped, and 0 marks end-of-file. It advances by the record length field rather than by consumed bytes, and validates the header and each record length against the remaining buffer.

How Verified

• go test ./... passes, including new tests.
• keytab describe -f example.kt still parses all three entries.
• head -c 50 example.kt > truncated.kt && keytab describe -f truncated.kt now prints Error parsing keytab file: keytab entry at offset 2 claims 62 bytes but only 48 remain instead of panicking.
• A keytab containing a valid hole record before the entries parses all three entries (the hole is skipped).

Test Coverage

• Added: src/keytab/Keytab_parsing_test.go:
  • Test_Keytab_TruncatedInputReturnsError — parsing every truncation prefix of a valid file never panics.
  • Test_Keytab_HoleIsSkipped — a negative-length hole record is skipped and the following entry parses.
  • Test_Keytab_EndOfFileMarker — a zero-length record terminates parsing and trailing bytes are ignored.

Scope of Change

• Files changed: src/keytab/Keytab.go, src/keytab/KeytabEntry.go, src/keytab/KeyBlock.go, src/keytab/CountedOctetString.go, src/keytab/Keytab_parsing_test.go
• Submodule pointer updated: no
• Behavioral changes outside the bug fix: none

Risk and Rollout

Local to the parse path; output of ToBytes/serialization is unchanged. Safe to merge directly.