Modbus: Bound the TCP PDU parse to the declared frame length

The length field is validated by the preceding commits but was never
enforced: the PDU came out of a QDataStream spanning the whole receive
buffer, and QModbusPdu sizes its data from the function code, so a
frame declaring less than the PDU it carries took the missing bytes
from whatever followed. No malformed length is needed, so the range
check does not catch it.

A server answered a frame that carried no request using the bytes of
the request behind it; a client given length 2 followed by "02beef"
returned NoError and handed the application register value 0xbeef.

Parse from a slice of exactly the declared PDU size. Conformant traffic
is unaffected: with one buffered frame the slice is what the parser
already saw.

Patch created with the help of Claude Opus 5, based on a deep-scan that
got concluded on this repository. Verified and corrected by myself.

Task-number: QTBUG-149968
Task-number: QTBUG-149969
Pick-to: 6.12 6.12.0 6.11 6.11.3 6.10 6.8
Change-Id: I4f1d34593abc0567a579775084058b8d20d360be
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>