[codex] Validate SOCKS5 auth field lengths

[madeye]

Summary

• reject empty SOCKS5 username/password fields during upstream proxy parsing
• reject credentials longer than the one-byte RFC 1929 length fields can encode
• build SOCKS5 auth frames through a checked helper so programmatic auth cannot truncate lengths

Tests

• cargo fmt --all -- --check
• cargo test upstream_proxy_rejects
• cargo test socks5_auth_request
• cargo test test_upstream_proxy_parse_socks5_auth
• cargo test
• cargo clippy --all-targets -- -D warnings
• git diff --check