Harden the mod against hostile servers and players

- PacketReader for all network data: lengths are checked against the real data
  (Mono allocated the claimed size first - a fake 2 GB length crashed the game)
- FsmSync: remote players can no longer switch arbitrary FSMs - never PLAYER /
  Systems / MSCO objects, CLICK only on FSMs that wait for a click, bolt/assembly
  events only along a transition the FSM really has for that event
- Time/weather (msco.world) and '* ' system-style chat only from the host in P2P
  (the dedicated server filters them itself); other msco.* ids are reserved

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

MSCO.csproj

@@ -99,6 +99,7 @@
     <Compile Include="VehicleAdmin.cs" />
     <Compile Include="WorldAdmin.cs" />
     <Compile Include="OilCheck.cs" />
+    <Compile Include="PacketReader.cs" />
     <Compile Include="ModApi.cs" />
     <Compile Include="ModLoader.cs" />
     <Compile Include="MenuBranding.cs" />