multi: update to tlv/v1.1.0 and use new *P2P tlv decoding variants

This changes the call-sites in several places to use the *P2P variants
to not trigger an OOM on untrusted input. This makes the code safe with
the new tlv version. Note that the call-sites prior to this change were
also safe.

lnwire/extra_bytes.go

@@ -97,7 +97,9 @@ func (e *ExtraOpaqueData) ExtractRecords(recordProducers ...tlv.RecordProducer)
 		return nil, err
 	}
 
-	return tlvStream.DecodeWithParsedTypes(extraBytesReader)
+	// Since ExtraOpaqueData is provided by a potentially malicious peer,
+	// pass it into the P2P decoding variant.
+	return tlvStream.DecodeWithParsedTypesP2P(extraBytesReader)
 }
 
 // EncodeMessageExtraData encodes the given recordProducers into the given