nginx HPACK decoder: single-byte OOB read in the dynamic table

The HPACK dynamic-table eviction path miscounts the entry length when a Huffman-coded name spans the ring-buffer wrap point. One byte past the allocation is read and reflected in a 400 response.