GHSA-w7hm-hmxv-pvhf: HPACK decoder panics on invalid input

The vulnerability stems from the update_max_dynamic_size function's unsafe error handling. The original implementation used decode_integer().ok().unwrap() which would panic on invalid input. This function was called during SizeUpdate field processing in decode(). The commit diff shows the fix changed this to proper error propagation using the ? operator. The test case with input 0x3f specifically triggers this code path by providing an incomplete size update value, demonstrating the panic scenario. The combination of direct unwrap usage and its critical role in header decoding makes this the clear vulnerable function.