No MRRU enforcement on MP fragment reassembly: peer can assemble oversized PDUs beyond negotiated MRRU

Summary

ng_ppp_get_packet(:1203-1234) reassembles first..last fragments accumulating m_pkthdr.len but never compares against negotiated MRRU(priv->conf.mrru). TX path enforces mru(:968-972) but RX does not. Peer sends valid fragments each within link MRU reassembling up to ~128*1500=192KiB >> MRRU. Bounded by MP_MAX_QUEUE_LEN=128 cap, int len cannot overflow. RFC 1990 non-compliance + resource amplification. Downstream consumer normally drops/truncates.