OOB read in ng_fixedstring_unparse: known bufSize ignored, delegates to unbounded strlen

Summary

ng_fixedstring_unparse(:785-796): knows fi->bufSize(:789) and advances *off by bufSize(:794), but delegates encoding to ng_string_unparse(:792) which uses unbounded strlen(raw). No NUL in fi->bufSize bytes -> strlen scans past field into adjacent message/heap. Fixedstring types widely used: NG_NODESIZ(32), NG_HOOKSIZ(32), NG_PATHSIZ(512), NG_TYPESIZ(32), NG_CMDSTRSIZ(32) — struct ng_mesg header fields + node defs.