fix(s7commplus): verify authenticated responses

[gijzelaerr]

Closes gijzelaerr/s7commplus#2.

Summary

• verify every SessionKey-protected V3 response with hmac.compare_digest before opcode routing or payload parsing
• preserve the legacy cumulative HMAC state across fragmented responses
• reject invalid/truncated digest envelopes, unsigned downgrade frames, and fragment-version changes
• raise a dedicated S7IntegrityError and close/reset the connection without sending on the untrusted stream
• verify interleaved notifications before queueing and require the verified reassembly path for authenticated Explore continuations

This PR is intentionally stacked on #883 because safe pre-parse verification depends on its response/notification dispatcher. Once #883 merges, this PR can be retargeted to master.

Verification

• uv run pre-commit run --all-files
• .venv/bin/pytest — 2,099 passed, 82 skipped
• uv build — wheel and sdist built successfully

[gijzelaerr]

This S7CommPlus work is now tracked in gijzelaerr/s7commplus#15. Pull requests cannot be transferred between repositories, so this PR is being closed in favor of the new-repository tracking issue.