fix(corekit): a length-less SchemaField passes -1 to its schema, so every list item warns 'packet length < 0' #1148

Describe the bug
A SchemaField declared without a length passes -1 to the nested schema as its remaining length. As each sub-field reads, the count goes further negative, so every item of a ListField built from such items emits SchemaWarning: packet length < 0. The bytes are still parsed correctly, but the warnings are spurious.

#1146 fixes this for HTTP/2 SETTINGS by giving the item a fixed length=6. The same pattern exists elsewhere with variable-length items, which cannot be given a fixed length:

• pcapkit/protocols/schema/internet/mh.py:907 (CGAParameter)
• pcapkit/protocols/schema/internet/hip.py:633 (Locator)

Expected behavior
A length-less SchemaField does not report a negative remaining length. Either the nested schema is told the true remaining length, or it gets a sentinel value that the length check ignores.

Additional context
Found by the #1140 worker. Not yet reproduced on mh or hip.