fix(device): bound descriptor scanner lengths

[andrescera]

What

• Validate each VideoControl and VideoStreaming descriptor length before dispatching the existing parser.
• Add deterministic synthetic coverage for zero, short-header, and oversized lengths in both descriptor iterators.
• Keep the exact 19-case hardware-independent regression inventory and document the follow-up.

Why

This is a focused follow-up to the post-merge review of 3d1924607e9bfe9cfebfa9d07ad3944dc4980225. That review found that both scanner loops trusted the next descriptor's declared length before checking the three-byte header minimum and remaining buffer length. Zero-length descriptors could fail to advance, while oversized lengths could underflow the remaining-byte accounting. The new scanner-level cases reproduce those inputs and the production guards return UVC_ERROR_INVALID_DEVICE before parser dispatch.

How to verify

• cmake -S . -B build/postcommit-gate -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_BUILD_TYPE=Debug -DCMAKE_BUILD_TARGET=Static -DBUILD_SHARED_LIBS=OFF -DBUILD_EXAMPLE=OFF -DBUILD_TEST=OFF -DBUILD_TESTING=ON
• ctest --test-dir build/postcommit-gate --output-on-failure
• The six scanner cases pass directly and the complete inventory is 19/19; sanitizer, shared/static, default-off, negative CMake, and actionlint checks are recorded in the attached local gate evidence.

Risks

The change is limited to malformed descriptor-length validation in the two existing iterator loops. Valid descriptors and parser behavior are unchanged; no USB hardware is required for these tests.