* Harden LDAP control decoding against malformed BER input
Change DecodeControl to return (Control, error) and validate control structure and value types instead of relying on unchecked access.
Handle decode failures on both server and client paths, returning protocol errors for bad request controls and surfacing response decode errors.
* fix: top-level recover() and fix missing TLSConfig check
* chore: verify fix