HLE: Check more guest buffers by their full length, and an empty insert

Calls that checked one byte of a game's buffer and then wrote or read the
whole thing, or trusted a negative length:
- sceNetEtherNtostr/Strton, the apctl BSS descriptor calls, GetState and
  sceNetGetDropRate.
- sceNpAuthGetTicket wrote its whole ticket whatever the length; it's
  now built locally and written once the buffer is known to hold it.
  sceNpAuthGetTicketParam checked its limits after copying, and walked
  ticket params past the ticket's end.
- sceNp2's communication ID and passphrase, a negative maxServerIds, and
  an unchecked unknown1Ptr.
- sceParseUri's work area and scheme string, sceParseHttp's negative
  header length and value address, and ReadVariableSizedStruct's size.
- sceKernelCreateLwMutex initialized the work area without checking it
  at all, and the other LwMutex calls checked one byte of it.
- sceNetAdhocctlGetScanInfo cleared the length the game gave, of a
  buffer checked by one byte (or any length, negative ones included).

Also: a game mode join inserted at begin() + 1 into a possibly empty
list of players.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Core/HLE/proAdhoc.cpp

@@ -1762,7 +1762,8 @@ void friendFinderPoll() {
 						gameModeMacs.push_back(*(SceNetEtherAddr *)adhocctl_event.connect.mac);
 					}
 					else {
-						it = gameModeMacs.begin() + 1;
+						// After the host, who's first - if the list has one yet.
+						it = gameModeMacs.empty() ? gameModeMacs.end() : gameModeMacs.begin() + 1;
 						gameModeMacs.insert(it, *(SceNetEtherAddr *)adhocctl_event.connect.mac);
 					}