isakmp: validate item_len before subtracting sizeof(ikev2_auth)

[vmihalis]

Summary

ikev2_auth_print() in print-isakmp.c subtracts sizeof(struct ikev2_auth)
(8 bytes) from the packet-supplied item_len without first checking that
item_len is large enough:

ND_PRINT(" len=%u method=%s", item_len-4, ...);
if (item_len > 4) {
        if (ndo->ndo_vflag > 1) {
                ND_PRINT(" authdata=(");
                if (!rawprint(ndo, (const uint8_t *)authdata,
                              item_len - sizeof(struct ikev2_auth)))

The caller only guarantees item_len > 4. When item_len is 5, 6 or 7,
item_len - sizeof(struct ikev2_auth) underflows to a large unsigned value
that is then passed as the length argument to rawprint().

This is the same pattern that commit 06db083 ("isakmp: validate item_len
before subtracting sizeof(ikev2_id)") fixed in the sibling function
ikev2_ID_print(). ikev2_auth_print() has the identical construct and was
left unchanged.

Impact

This is a defense-in-depth / consistency fix, not a crash fix. The underflowed
length reaches only rawprint(), whose first action is ND_TCHECK_LEN(); that
bounds check fails closed on the oversized value and longjmps to the truncation
handler, so no out-of-bounds read occurs today. The change makes the bounds
check explicit at the subtraction site and brings ikev2_auth_print() in line
with the fix already applied to ikev2_ID_print().

Fix

Add an explicit lower-bound check before the subtraction, mirroring
ikev2_ID_print():

if (item_len < sizeof(struct ikev2_auth)) {
        ND_PRINT(" [payload too short]");
        return (const u_char *)ext + item_len;
}

Testing

• ./autogen.sh && ./configure && make builds cleanly.
• Two regression tests added, mirroring the ikev2-id-{normal,short} tests
  from commit 06db083:
  • ikev2-auth-normal -- a valid IKEv2 AUTH payload; output unchanged.
  • ikev2-auth-short -- an AUTH payload with item_len = 5; output is now
    [payload too short].
• The full test suite was run with and without this change: it alters no
  existing test result, and both new tests pass.