[kvinwang]

Problem

Follow-up to #1477; same input (a host-controlled vTPM), same impact (the guest aborts or stalls during boot):

• TpmlPcrSelection and TpmlDigest unmarshal call Vec::with_capacity(count) with the TPM-supplied u32 count, and add_command_capability does the same with count + 1. count = 0xFFFFFFFF in a 4-byte buffer asks for ~100 GB before the first element fails to parse; the pcr_read paths reach this in the guest.
• get_random loops until it has num_bytes; a TPM that keeps answering with an empty TPM2B makes it spin forever.
• get_handles resumes at last_seen + 1; a TPM that answers more_data with a handle below the requested property sends it back to the same range forever.
• nv_read does not truncate to the NV index's data_size (its sibling nv_read_with_auth does), so oversized chunks are returned as-is.

Fix

• Cap the preallocation at what the remaining buffer could hold (count.min(buf.remaining()), / 4 for u32 attributes). Every entry consumes bytes, so a larger count fails with the existing underflow error.
• get_random bails on an empty response.
• get_handles bails when the TPM's last handle is below the requested start.
• nv_read truncates to data_size, as nv_read_with_auth already does.

Verification

New test a_huge_list_count_fails_without_preallocating, run under ulimit -v 4000000:

• with the fix: passes;
• with the old with_capacity(count): memory allocation of 103079215080 bytes failed, process aborts.

New test get_handles_stops_when_the_tpm_goes_backwards (stream-backed fake TPM answering more_data with a handle below the range): the fixed code errors after 1 request; without the check it keeps asking and only stops when the fake TPM hangs up after 4.

cargo test -p tpm2 passes; cargo clippy -p tpm2 -- -D warnings -D clippy::unwrap_used -D clippy::expect_used clean.