fix: bounds check before slicing decrypted AES-CBC data

[travis-barnett]

Summary

For Chrome db version >= 24, decryptAESCBC strips 32 bytes of prefix padding from the decrypted data. If the decrypted value is shorter than the prefix padding (e.g. empty or very short cookie values), this causes a panic:

panic: runtime error: slice bounds out of range [32:23]

goroutine 1830 [running]:
github.com/browserutils/kooky/internal/chrome.decryptAESCBC(...)
    internal/chrome/chrome.go:356 +0x404

This adds a bounds check to return an error instead of panicking, allowing the iterator to skip the bad cookie gracefully.

Change

Added a check before the final slice in decryptAESCBC():

if len(decrypted)-paddingLen < prefixPaddingLen {
    return nil, fmt.Errorf("decrypted data too short (%d bytes) for prefix padding (%d bytes)", len(decrypted)-paddingLen, prefixPaddingLen)
}

This is a follow-up to commit 00fc21c which fixed the similar crypto/cipher: input not full blocks panic.

🤖 Generated with Claude Code

[daboyuka]

This is a secondary edge case bug in the fix for #92 .