Refuse a PDU whose optional parameters do not end on command_length (#87)

* Regression tests for a truncated TLV tail refused rather than accepted

* Refuse a PDU whose optional parameters do not end on command_length

* Assert the bare TLV header refusal against jsmpp instead of recording it as a defect

* Note the truncated TLV tail defect as fixed in the java-client findings

* Derive the padding position, share the bare TLV fixture and trim the decision record

* Regression tests for a PDU whose trailing C-Octet String a peer left out

* An absent trailing C-Octet String consumes no octet, so a bodyless PDU still parses

* Bound the TLV loop by the buffer it was given rather than a second spelling of its length

* Answer the stability review's questions in the record and pin the array contract

src/defs/commands.ts

@@ -19,7 +19,8 @@ const bindParams = {
 
 /**
  * Key order inside each `params` object is the order the fields appear on the wire. Reordering
- * them corrupts every PDU of that command.
+ * them corrupts every PDU of that command, and moving a field after `short_message` also stops the
+ * codec skipping the NULL octet some peers append to it.
  */
 const specs = {
 	alert_notification: {