feat(security): add explicit XDR length guard on returned Bytes values

[Bolajiomo99]

Summary

Closes #894

Add an explicit XDR byte-length guard (guard_bytes_len) on Bytes values
returned from public contract entry points so consumers cannot be DoS'd by an
unbounded allocation.

---

Threat being mitigated

DoS via unbounded ScBytes deserialization.

The Soroban XDR ScBytes type carries a 4-byte unsigned length prefix with no
host-enforced upper bound before the bytes are handed to the caller. Without an
explicit check on the contract side, a misbehaving or supply-chain-compromised
contract could return an arbitrarily large Bytes payload. Every downstream
consumer — JavaScript SDK, Horizon indexer, RPC node, third-party integration —
must allocate a buffer proportional to len to deserialize the value. A 2 GiB
len field would OOM almost any process.

This is a defence-in-depth fix. There is no public incident. The gap is the
kind a careful auditor would flag before any external review, and closing it now
is cheaper than remediating it under fire.

---

What changed

File	Change
remitwise-common/src/lib.rs	MAX_BYTES_RETURN = 8192, typed BytesReturnError::ReturnTooLarge (#[contracterror]), guard_bytes_len() helper
remittance_split/src/lib.rs	ReturnBytesTooLarge = 28 in RemittanceSplitError; get_request_hash now returns Result<Bytes, RemittanceSplitError>; guard applied before returning; distribute_usdc_hashed propagates with ?
remitwise-common/src/tests.rs	4 unit tests for guard_bytes_len (empty, at-limit, one-over-limit, far-above-limit)
remittance_split/src/test.rs	1 new contract-level test (test_get_request_hash_passes_xdr_length_guard); 8 direct struct call sites updated to .unwrap()

---

Acceptance criteria

• Change matches the summary — reject returns > MAX_BYTES_RETURN
• Negative test exercises the new check (test_guard_bytes_len_rejects_oversized_value — could not be written before the fix, passes after)
• PR description names the threat being mitigated (unbounded ScBytes allocation → consumer DoS)
• Typed #[contracterror] (BytesReturnError::ReturnTooLarge) surfaced instead of panic or generic error
• WASM build passes: cargo build -p remittance_split --target wasm32-unknown-unknown --release
• remitwise-common lib clippy clean: cargo clippy -p remitwise-common --lib -- -D warnings
• #![no_std] discipline maintained — no std:: calls introduced

---

Performance

guard_bytes_len is a single u32 comparison (bytes.len() > 8192). SHA-256
always produces exactly 32 bytes, so the guard exits the fast path immediately.
No measurable overhead on the hot path.

---

Out of scope

Pre-existing test failures and clippy warnings in the test file are not touched,
per the issue's out-of-scope guidance.