Disconnect LE credit-based channels on invalid SDU lengths

[deadcaf3]

Problem

LeCreditBasedChannel.on_pdu used an SDU length of 0 to mean "length not known yet". A PDU announcing a zero-length SDU therefore never completed, and every PDU that followed was appended to the same buffer without limit. Separately, an SDU length above the channel's MTU was accepted and the SDU delivered.

Reproduction on a channel with an MTU of 100 bytes:

• 2000 PDUs of 50 bytes, the first announcing SDU length 0: 0 SDUs delivered, buffer growing with every PDU.
• One SDU of 5000 bytes: delivered in full.

Change

All in LeCreditBasedChannel.on_pdu:

• A zero-length SDU is delivered as an empty SDU.
• An SDU length above the MTU, or more payload than the SDU length announced, sends a disconnection request. This resolves the existing TODO: we should disconnect.
• PDUs received while the channel is not connected are dropped, as the log message already said. Without this, a peer that ignores the disconnection request could keep feeding the channel.

Testing

• New tests in tests/l2cap_test.py: test_zero_length_sdu and test_invalid_sdu_length (3 cases). All 4 fail without the fix and pass with it.
• Full test suite: 1020 passed, 9 skipped.
• black -S --check, ruff check, and pylint -E are clean; mypy reports nothing for the changed files.

[zxzxwu]

LGTM, thanks!