Validate DTLS 1.2 datagram order and back off flight resends

[algesten]

Summary

Discard DTLS 1.2 datagrams whose handshake message_seq values decrease before classifying or queueing records. Equal sequences remain valid for fragments, and datagrams can arrive out of order. Validate CCS/epoch ordering before peer encryption starts.

Keep the first duplicate-triggered flight resend immediate, then suppress further duplicate responses during exponential backoff. Restart the flight timer after early resends and retain a cooldown for final-flight replies after periodic retransmission stops.

Add regressions for successful clean retransmission after a scrambled datagram is discarded, reordering across datagrams, fragment sequence repeats, and resend cooldown behavior.

[algesten]

Review-cycle round 1: no actionable findings against the complete PR at 768b0bc4025cbf2547f07150e51683714109261c.

Reviewed datagram validation before classification/queueing, repeated fragment sequences, ordering across datagrams, pooled-buffer cleanup, flight timer restart, duplicate cooldown expiry/reset, and final-flight recovery after periodic retransmission stops. The proposed scope remains limited to DTLS 1.2.

Validation passed:

• CARGO_TARGET_DIR=/Users/martin/dev/dimpl/target cargo test --offline --quiet — 593 passed, 2 ignored.
• CARGO_TARGET_DIR=/Users/martin/dev/dimpl/target cargo test --offline --no-default-features --features rust-crypto --quiet --lib dtls12:: — 97 passed; existing unrelated test warnings remain.
• cargo fmt --all -- --check
• CARGO_TARGET_DIR=/Users/martin/dev/dimpl/target cargo clippy --offline -- -D warnings

No regression-test commit was needed. Both the PR worktree and the main checkout remain clean.