Fix GSS C25519 server blob bounds check

The GSS Curve25519 client path checked sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] when rejecting public keys with the high bit set. That indexes one byte past the end of the sshbuf payload.

The byte after Q_S is the first byte of the following MIC string length, encoded in network byte order. With OpenSSH's packet size limit this byte is normally zero, so the bug usually made the intended high-bit rejection a no-op rather than causing random failures.

A peer can send a high-bit-set Q_S, but it still has to produce the GSS MIC over the exchange hash for the exact values used. This does not appear to provide key compromise or authentication bypass; it is a correctness fix for the validation policy carried by the GSS KEX patch.

Reject an empty server blob explicitly, then test the last payload byte at sshbuf_len(server_blob) - 1 before passing the blob to kex_c25519_dec().