Bound RTM Base58/Bech32 address input lengths to mitigate DoS

[MoneroOcean]

Motivation

• Prevent untrusted daemon-supplied RTM payee addresses from triggering unbounded BigInt work, large buffer allocations, or event-loop/blocking by rejecting overlong inputs before decoding.

Description

• Add MAX_BASE58_ADDRESS_LENGTH and MAX_BECH32_ADDRESS_LENGTH constants and an early length check in decodeBase58Check to reject excessively long Base58 inputs before performing BigInt arithmetic.
• Add an early length check in addressToScript to reject overlong addresses before attempting Base58 or Bech32 decoding, leaving valid address handling unchanged.

Testing

• Inspected the rtm.js diff to confirm only minimal length checks were added around decodeBase58Check and addressToScript, and no other logic was changed.
• Attempted to load rtm.js with Node (require('./rtm.js')) but runtime execution could not be completed in this environment because the bech32 dependency is not installed, so full dynamic tests were not run.

---

Codex Task