upb: validate message tags before consuming depth

[srkyn]

Summary

• Validate a linked-message fasttable slot against the actual tag before entering the message path.
• Keep mismatched tags on the existing fallback path.
• Add a regression test for a valid unknown field at an exact recursion-depth boundary.

Without this ordering, the fast decoder can return MaxDepthExceeded for a valid message that the generic decoder accepts because it consumes depth before discovering that the tag does not match the message slot.

Testing

• DecodeTest.MismatchedMessageSlotDoesNotConsumeDepth passes with the fast and generic decoders.
• Full sanitized upb-test: 535 passed, 1 existing skip.
• Patched current-main differential fuzzing: 1,000,000 executions with no decoder mismatch or sanitizer finding.
• Patched v36 differential fuzzing: 3,000,000 executions with no decoder mismatch or sanitizer finding.