Yet more xfr* hardening

[miodvallat]

Short description

This make sure the two-argument form of xfrBlob (and xfrBlobNoSpaces) will not access data out of the packet buffer, when reading from a packet.

Reported by Naija_Overflow in YWH-PGM6095-292, many thanks!

Checklist

I have:

• read the CONTRIBUTING.md document
• read and accepted the Developer Certificate of Origin document, including the AI Policy, and added a "Signed-off-by" to my commits
• compiled this code
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)