fix(tcp): unknown MPTCP subtypes (incl. MP_TCPRST) read one octet past the option #1214

Describe the bug
At schema/transport/tcp.py:826 the unknown-subtype data field is sized length - 2, but the subtype octet has already been consumed, so the field overruns by one octet. This hits MP_TCPRST (subtype 8, which has no registered handler), 0xf and every unassigned subtype.

To Reproduce
1e048001 rebuilds as 1e05800100000100, with the option length growing from 4 to 5.

Expected behavior
The data field is sized length - 3 and the option rebuilds byte-exactly.

Found by the transport round-trip audit (#1202). I re-ran the repro on main at 630f0a581.