Bind connection responses to their own mapping challenge

[gafferongames]

Bind connection challenges to the connect token that created the server's encryption mapping. Previously, a response encrypted under token B's packet key could carry token A's challenge and connect as A with A's user data. The server now authenticates each challenge with that token's private-data MAC and refuses a response when its mapping has no token entry.

A socketless regression and a C-reference differential script compare eight handshake steps, including a cross-token response and two in-flight challenges for one token. The C and Go scripts receive the same serialized tokens, explicit timestamp, and test-only challenge key; the differential test compares both the eight-step outcomes and every encrypted request/response datagram byte-for-byte. The existing nil-associated-data round trip remains covered. The two wire compatibility fixture calls pass nil explicitly; no binary vectors or standard text changed.

Validation on guarded Linux: focused unit, C differential, full go test ./..., targeted race+C, and read-only gofmt all passed at the final head. The exact race command was:

Go HEAD: b8e0d18a76519cd5e1e8ec4f9126b8de39ab4710
C reference HEAD: 39f049657d6e738e533c751c2b5242fa7b2d4114
cd /home/nova/netcode-work-20261014/go-challenge-w1/final-same-input-v3
nice -n15 timeout 660s env PATH=/home/nova/sdk/go1.26.6/bin:/usr/bin:/bin NETCODE_C_DIR=/home/nova/netcode-work-20261014/go-challenge-w1/cref GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off GOCACHE=/home/nova/netcode-work-20261014/go-challenge-w1/gocache-same-input GOMODCACHE=/home/nova/go/pkg/mod TMPDIR=/home/nova/netcode-work-20261014/go-challenge-w1/tmp-same-input GOMAXPROCS=4 go test -race -count=1 -run 'TestChallengeTokenBindsToItsConnectToken|TestConnectionResponseRefusesAnotherMappingsChallenge|TestCDifferentialConnectionResponse' .