fix: clean up misc TODO comments and improve UDP source filtering (#89)

- http/httpraw: cap header slice growth to pre-allocated capacity, fix
  benchmark to reuse Header across iterations (0 allocs/op)
- internal/ring: replace TODO panic comments with invariant explanations
- tcp/conn: document truncated-frame offset check
- tcp/handler: replace TODO with net.ErrClosed on RST-closed connection
- internet/stack-udpport: filter incoming packets by remote IP address
  when configured via SetStackNode; skip filter for IPv4 multicast
  destinations (class D) so mDNS and similar protocols work correctly

Generated with LLM assistance.

Signed-off-by: Marvin Drees <marvin.drees@9elements.com>

tcp/conn.go

@@ -362,7 +362,9 @@ func (conn *Conn) Demux(buf []byte, off int) (err error) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 	if off >= len(buf) {
-		return lneto.ErrTruncatedFrame // TODO: this check is bad.
+		// off is the IP header length; if it equals or exceeds the frame
+		// length, there are zero bytes of TCP payload — drop the frame.
+		return lneto.ErrTruncatedFrame
 	}
 	raddr, _, id, _, err := internal.GetIPAddr(buf[:off])
 	if err != nil {

tcp/handler.go

@@ -174,8 +174,7 @@ func (h *Handler) Recv(incomingPacket []byte) error {
 	err = h.scb.Recv(segIncoming)
 	if err != nil {
 		if h.scb.State() == StateClosed {
-			// TODO(soypat): Should return EOF/ErrClosed?
-			err = net.ErrClosed //err // Connection closed by reset.
+			err = net.ErrClosed // Connection closed by RST; signal caller to tear down.
 		}
 		return err
 	}