fix: RPKI validation returns Invalid for max_length exceeded

[digizeph]

Summary

Fixed a bug where RPKI validation incorrectly returned Unknown when a prefix was covered by an ROA but exceeded the max_length restriction. Now correctly returns Invalid.

Root Cause

In lookup_by_prefix(), ROAs were filtered by max_length >= prefix.prefix_len(). When validating a more specific prefix (e.g., /24 covered by a /23 ROA with max_length 23), the ROA was filtered out, causing validate() to see empty matches and return Unknown instead of Invalid.

Changes

• Added lookup_covering_roas() helper method to find all covering ROAs without max_length filter
• Modified validate() to check coverage first before filtering by max_length
• Modified validate_check_expiry() with the same fix
• Added comprehensive tests for the bug scenarios

Validation Logic

• No covering ROA exists → Unknown
• Covering ROAs exist but none authorize prefix (wrong ASN or max_length exceeded) → Invalid
• Covering ROA matches ASN and max-length → Valid

Tests

• test_validate_max_length_exceeded - Core bug scenario
• test_validate_check_expiry_max_length_exceeded - Expiry-aware validation
• test_lookup_covering_roas - Helper method

All RPKI tests pass.