watchtower/wtdb: only accept properly sized blobs

Modifies the bbolt and mock tower databases to only accept blobs that
are the expected size of the session's blob type. This prevents resource
exhaustion attacks where a client may provide disproportionately large
encrypted blob, even though all supported blob types are of fixed-size.

watchtower/wtmock/tower_db.go

@@ -37,6 +37,11 @@ func (db *TowerDB) InsertStateUpdate(update *wtdb.SessionStateUpdate) (uint16, e
 		return 0, wtdb.ErrSessionNotFound
 	}
 
+	// Assert that the blob is the correct size for the session's blob type.
+	if len(update.EncryptedBlob) != blob.Size(info.Policy.BlobType) {
+		return 0, wtdb.ErrInvalidBlobSize
+	}
+
 	err := info.AcceptUpdateSequence(update.SeqNum, update.LastApplied)
 	if err != nil {
 		return info.LastApplied, err