Harden capability parsing

Don't check only the number of capabilities but also the remaining size in the stream
Merge pull request #1635 from hardening/capa_fixes

Harden capability parsing