fix(s7commplus): verify authenticated responses

[gijzelaerr]

Closes #832.

Summary

• verify every SessionKey-protected V3 response with hmac.compare_digest before opcode routing or payload parsing
• preserve the legacy cumulative HMAC state across fragmented responses
• reject invalid/truncated digest envelopes, unsigned downgrade frames, and fragment-version changes
• raise a dedicated S7IntegrityError and close/reset the connection without sending on the untrusted stream
• verify interleaved notifications before queueing and require the verified reassembly path for authenticated Explore continuations

This PR is intentionally stacked on #883 because safe pre-parse verification depends on its response/notification dispatcher. Once #883 merges, this PR can be retargeted to master.

Verification

• uv run pre-commit run --all-files
• .venv/bin/pytest — 2,099 passed, 82 skipped
• uv build — wheel and sdist built successfully