Extra hardening of the parser for the ClientHello packet

Problem:

If the username terminator is the last byte in the packet, passwd can reach the end of the packet buffer. The code then dereferences *passwd before checking bounds, leading to a potential out-of-bounds read, if the whole packet was never zero terminated by the lower layers.

Fix: Add a boundary check DEBUG_ASSERT before the dereference.