test(ecdsa): exercise the real trailing-bytes rejection branch

[dormouse-bot]

Surfaced by the nightly code-quality survey.

The DER parsing rejects malformed input test intended to cover the trailing-bytes rejection in ecdsaDerToRaw (invalid DER: trailing bytes), but it appended a byte outside the declared SEQUENCE length. That trips the earlier offset + sequenceLength !== der.length guard (invalid DER: length mismatch) first, so the genuine trailing-bytes branch — extra bytes inside the declared SEQUENCE length, after both INTEGERs — was never exercised. The assertion only passed because it matched the broad /invalid DER/ regex, so a regression in that branch would have gone undetected.

This PR splits the case in two:

• Byte appended outside the length — tightened to assert /length mismatch/, which is what it actually reaches.
• Byte counted inside the length (declared SEQUENCE length bumped to match) — passes the length check and both INTEGER reads, reaching the real /trailing bytes/ branch.

Test-only change. Full server-lib-common suite passes locally (pnpm test → 111 pass, 0 fail).

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	c05abe0
Status:	✅  Deploy successful!
Preview URL:	https://127bf7f6.mouseterm.pages.dev
Branch Preview URL:	https://nightly-ecdsa-trailing-bytes.mouseterm.pages.dev

View logs