Fix secure packet trim regression fixture

[fdesbiens]

Summary

• copy mock decrypt input into the output buffer for deterministic plaintext
• replace the impossible 1,983-byte MAC size with the valid SHA-256 size
• explicitly model successful authentication of an empty application record
• expect the packet-boundary continuation result consistently across TLS profiles

Follow-up to #428. This addresses the nx_secure / Dev-Secure failure on #427.

Testing

• GCC 14.2, CMake, and Ninja: ./scripts/build_secure.sh all
• Full secure matrix: ./scripts/test_secure.sh all — 19 profiles and 2,930 tests passed
• GCC 14.2 interoperability build: ./scripts/build_secure_interoperability.sh all — all 18 profiles built
• Local interoperability execution requires interactive root network privileges. The current Added conditional dev CI routing #427 CI run passed every interoperability test it completed before the separate 30-minute step timeout.