mapi_lib: restore g_proprow tag set reduction

EXT_PULL::g_recipient_row pulled more bytes off the ROP command
buffer than it should have, and then the parse eventually returned
pack_result::format. (Managed to trigger it with one MAPI_TO and one
MAPI_BCC recipient).

In the caller, `g_recipient_row`, this had changed:

```
-	if (r->count > pproptags->count)
+	if (r->count > tags.size())
		return pack_result::format;
-       proptags.count = r->count;
```

This is not just an overflow check; one has to realize that r->count
can legitimately be smaller than tags.size() and that a subset of
tags is passed down from g_recipient_row to g_proprow.

Fixes: gromox-3.0-107-ga2c814f32
References: GXH-181

Author: jengelh

lib/mapi/ext_buffer.cpp

@@ -1664,7 +1664,7 @@ pack_result EXT_PULL::g_recipient_row(std::span<const proptag_t> tags, RECIPIENT
 	TRY(g_uint16(&r->count));
 	if (r->count > tags.size())
 		return pack_result::format;
-	return g_proprow(tags, &r->properties);
+	return g_proprow(tags.subspan(0, r->count), &r->properties);
 }
 
 pack_result EXT_PULL::g_modrcpt_row(std::span<const proptag_t> tags, MODIFYRECIPIENT_ROW *r)