zero lengths passed by reference too
move bounds check to correct place
make sshbuf_get_cstring use sshbuf_peek_string_direct

this is a bit safer, as it centralises length checking, etc.