QGrpcHttp2Channel: validate server-sent grpc-status range

The parsed value was cast directly to StatusCode without a range check.
A hostile server could send e.g. "99" or "-1", narrowing into an
undefined StatusCode enumerator that application switch statements may
branch on unpredictably.

Reject any value outside [0, Unauthenticated] with StatusCode::Unknown
instead, mirroring upstream gRPC's own GRPC_STATUS_UNKNOWN fallback for
invalid status codes.

Pick-to: 6.12 6.11 6.8
Fixes: QTBUG-148148
Change-Id: Ib251e39459cd44786e9264e2b4e6657ae8b6128e
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>