fix: Make rlp_decode_length() self-bounded with an explicit bufferLength

rlp_decode_length() dereferenced its `buffer` argument and then
indexed up to four bytes past the prefix without any length
parameter. Safety relied entirely on the caller running
rlp_can_decode() first — a sibling helper that does check
bufferLength. The single in-tree caller (eth_ustream.c) follows that
discipline, but a future call site that skipped rlp_can_decode would
silently OOB-read into adjacent memory.

Add a bufferLength parameter to rlp_decode_length(), reject zero-
length input up front, and reject inputs shorter than the encoded
length prefix in the long-string / long-list branches. Update the
existing caller to pass context->rlpBufferPos. The function now
upholds its own invariant instead of relying on its companion.

(cherry picked from commit ad3fb1fc108544c9bcb207b7780a75a3aba592cb)