hpke: Enforces passing a slice of exact size to UnmarshalBinary for KEM keys

[armfazh]

hpke: Allows passing a larger buffer to UnmarshalBinary for KEM keys.
It checks data passed is in the right boundaries.
Also adds a test showing the issue.

Fixes #488

[bwesterb]

Why should we accept a buffer that is too large? Wouldn't we miss certain bugs if we do?

[armfazh]

Agree, I have changed the code, so now, it enforces passing a slice of the exact size when unmarshaling keys. Otherwise, it returns an error instead of panic, which is the actual bug reported in #488 .

[karalabe]

I just shot myself in the foot with this. I assumed the key size is always checked (it is for other unmarshal methods). I had a flaw in parsing out a PEM key from a file and gave the unmarshal method the entire pem container, not just the raw bytes. No error, no nothing until I paired it up in prod with a Rust HPKE lib that rejected the crypto. That's when I found the unmarshal was doing junk all along. Would be very nice to get this in.