harden http/2 frame read handling by enforcing length bytes actually read