multiport: validate the peer's port range, warn when a lane never comes up

- Ignore a lane advert with a zero base port or a range running past 65535,
  with a warning, instead of aiming lanes at ports that wrapped.
- Warn once when a lane that has never come up misses 3 probes in a row.
  Until now that was silent above debug, including the common case of a
  firewall that only opens the base port.

handshake/machine.go

@@ -345,8 +345,8 @@ func (m *Machine) processPayload(msg []byte, flags msgFlags) error {
 		// Multiport advert from the peer's side of the exchange. Out-of-range
 		// values mean a peer we can't pair lanes with; ignore the advert
 		// rather than failing the handshake — the tunnel itself is fine, it
-		// just won't get lanes. Semantic policing (port-count caps, lane
-		// clamping) belongs to the handshake manager.
+		// just won't get lanes. Semantic policing (the port range, lane
+		// clamping) belongs to the handshake manager and newLaneSet.
 		var peerLanes *LaneDetails
 		if m.result.Initiator {
 			peerLanes = payload.ResponderLanes