fix(ipv4): TS zeroes a trailing 1-3 octet partial slot on rebuild #1392

Describe the bug
A TS option whose length leaves 1–3 octets after the last whole slot has those octets zeroed on rebuild. _read_opt_ts does no (length - 4) % 4 check, unlike LSR, SSR and RR, which reject such lengths with ProtocolError. The tail sits in the zero-packing PaddingField (schema/internet/ipv4.py:338-346) and _make_opt_ts never carries it (ipv4.py:1670). #1390 fixes the whole-slot case, but at its head a15053649 this one still reproduces, because its remaining field holds whole words only.

To Reproduce
from_data round trip, option bytes in → out:

• 44070500 aabbcc → 44070500 000000
• 440b0900 00000005 aabbcc → 440b0900 00000005 000000

Expected behavior
The tail survives byte-exact, or the reader rejects a misaligned length as LSR, SSR and RR do.

Reproduced on main at 66950b1f2; found by the #1390 cross-review. Blocked until #1390 merges, since it is the same code.