fix(protocols): understated __length_hint__ and an unguarded next-layer import still fabricate octets #1173

Describe the bug
#1171 rewrites a next layer as Raw when fewer octets were captured than its __length_hint__. Two hints understate the real minimum header, and one import path skips the guard, so short streams can still fabricate octets:

• IPv6_Route.__length_hint__ returns 4 (ipv6_route.py:392), but the fixed header is 8 octets.
• MH.__length_hint__ returns 6 (mh.py:1582), but the minimum is 8.
• ApplicationBase._import_next_layer (application.py:132) does not go through ProtocolBase._parse_next_layer (protocol.py:1835).

To Reproduce
On main 8565b7450, a zero-filled IPv6_Route body of 4–7 octets, or an MH body of 6–7 octets, is still parsed and rebuilds to more octets than were captured (the #1171 cross-review measured 24–27 captured → 28 rebuilt).

Expected behavior
Each __length_hint__ is the true minimum header length, and every _import_next_layer routes through the shared guard, so a short stream rebuilds exactly what was captured.

Additional context
Found by the #1171 cross-review. Ruling on #1170: a header cut short becomes Raw.