only update UnorderedCrypter replay state after decryption succeeds

[uwezkhan]

UnorderedCrypter::decrypt records the nonce in buffered_read_nonces and advances furthest_read_nonce before aes_gcm_256_decrypt runs. The nonce travels beside the ciphertext and is not covered by the AEAD tag (UnorderedChannelEncryptor::decrypt reads it straight off Payload::nonce), so on the unreliable transports this crypter targets, whoever can put a packet on the wire picks it. Before: a forged packet reusing a nonce the sender has not sent yet makes the genuine message carrying that nonce fail with ReplayedNonce, and one packet with a far-ahead nonce ratchets the window past everything still in flight.

After: the window moves only once the tag verifies, so a forged packet costs one failed decryption and nothing more, which is what RFC 4303 3.4.3 and RFC 6347 4.1.2.6 require of an anti-replay window. The check belongs in the crypter because that is the only layer holding the window state and the first point where the nonce is trustworthy. Tradeoff: the replayed-nonce lookup now runs against the whole buffered set rather than only the span at or below furthest_read_nonce, costing one extra hash lookup for nonces above the window; accepted traffic, out-of-order tolerance and window sizing are unchanged.