Harden STARTTLS handlers and add per-dialect tests

Bound line reads with readLineLimited to prevent a peer from exhausting
memory by withholding line terminators, wrap previously bare error
returns for consistent context, surface XML decoder Skip errors, and
replace the goto in the XMPP feature scan with a labeled break. New
starttls_test.go exercises SMTP/IMAP/POP3/XMPP/LDAP success and
not-advertised paths through net.Pipe-mocked servers.

checker/starttls_xmpp.go

@@ -32,6 +32,7 @@ func starttlsXMPP(conn net.Conn, sni, ns string) error {
 
 	// Read the inbound <stream:stream> opening and its <stream:features>.
 	hasStartTLS := false
+outer:
 	for {
 		tok, err := dec.Token()
 		if err != nil {
@@ -50,17 +51,18 @@ func starttlsXMPP(conn net.Conn, sni, ns string) error {
 						if ee.Name.Local == "starttls" {
 							hasStartTLS = true
 						}
-						_ = dec.Skip()
+						if err := dec.Skip(); err != nil {
+							return fmt.Errorf("skip feature %q: %w", ee.Name.Local, err)
+						}
 					case xml.EndElement:
 						if ee.Name.Local == "features" {
-							goto doneFeatures
+							break outer
 						}
 					}
 				}
 			}
 		}
 	}
-doneFeatures:
 	if !hasStartTLS {
 		return fmt.Errorf("%w: XMPP features did not advertise starttls", errStartTLSNotOffered)
 	}