Fix reports from static analyzer

[gasbytes]

• 3f373bf - Send challenge ACK and drop in-window SYN segments on synchronized connections (ESTABLISHED, CLOSE_WAIT, FIN_WAIT_1, FIN_WAIT_2, CLOSING) per RFC
  9293 s3.10.7.4
• dee5bb3 - Send challenge ACK and drop in-window SYN segments on LAST_ACK state per RFC 9293 s3.10.7.4
• cc30b85 - Fix fast recovery to use FlightSize for ssthresh, inflate cwnd by 3*SMSS on entry and by SMSS on subsequent dup ACKs per RFC 5681 s3.2
• db8380b - Add PAWS validation: reject segments with stale timestamps by sending ACK and discarding per RFC 7323 s3.2
• 0e5d1c1 - Defer ESP anti-replay window update until after ICV verification per RFC 4303 s3.4.3
• 69746df - Add dhcp_msg_type() helper and handle DHCPNAK by restarting discovery per RFC 2131 s4.4.1
• d665201 - Abort DNS query on non-zero RCODE instead of waiting for retry timeout per RFC 1035 s4.1.1
• 88d73b7 - Substitute zero UDP checksum with 0xFFFF per RFC 768
• c2818e9 - Add segment acceptability check to LAST_ACK state per RFC 9293 s3.10.7.2
• a21af7d - Guard dns_id assignment against zero sentinel collision when wolfIP_getrandom truncation yields zero