Modbus: Drop TCP connection on an invalid MBAP length field

A declared MBAP length of 0 underflowed to 0xffff on the decrement, and
the frame size was computed into a quint16, so it truncated back under
the buffer check. The server consumed the wrong byte count and lost
frame synchronization for good: one unauthenticated 7-byte header made
it emit spurious responses carrying attacker-supplied transaction and
protocol identifiers.

Compute the frame size in an int and range check it, accepting only the
8 to 260 bytes a real frame can span. Outside that range the next
frame's start is unknowable, so close the connection rather than
resynchronize by guesswork.

The check and the size arithmetic live next to the framing constants in
qmodbus_symbols_p.h, so the client can apply the same rule.

Disconnect before reporting: setError() emits errorOccurred()
synchronously, and a slot may delete the socket it received from
acceptNewConnection().

Patch created with the help of Claude Opus 5, based on a deep-scan that
got concluded on this repository. Verified and corrected by myself.

Fixes: QTBUG-149968
Pick-to: 6.12 6.12.0 6.11 6.11.3 6.10 6.8
Change-Id: I9aa1ddf5b6a98d05a1bdd51938118b28645f6096
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>