Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

Reader.readPacket() reassembles multipart packets by reallocating the receive buffer for each 0xffffff-length fragment with no size ceiling. A malicious or MitM'd server can stream endless max-length fragments and drive the client to OutOfMemoryError before authentication.

No legitimate packet during the handshake/authentication phase is anywhere near 16 MB, so multipart reassembly should not be permitted at that stage at all.