fix: Reject empty plugin name in handle_set_external_plugin

handle_set_external_plugin() trusted the host-supplied length byte
end-to-end: a zero-length name passed every existing check, the
SHA-256 hash was computed over an empty name prefix, and only the
Ledger PKI signature verification stood between the request and a
plugin registration with pluginName = "". The downstream alias
matching uses strcmp() against entries like "-erc20", so an empty
alias would never match any internal plugin and the registration
would be inert — but the device would still have stored a useless
plugin context and surfaced a stale name on subsequent screens.

Reject pluginNameLength == 0 explicitly before any further work.
This is defense in depth against a backend that signs a malformed
payload, not a bypass of the PKI gate.

(cherry picked from commit f93ef3b34cf591f1ad35e41945df301ebf9ab9f3)