fix(importers): prevent malformed/truncated WinSCP password imports

[Orinks]

Summary

• handle WinSCP encrypted password offset/padding bytes during decryption
• reject keyed payloads when the decrypted prefix cannot be validated, returning an empty password via the existing safe wrapper
• add tests for offset/padding decryption and key-prefix mismatch fallback

Root Cause

The importer was reading WinSCP payload bytes immediately after the length header and ignored the encoded offset/padding segment used by some session formats. That misaligned reads and produced malformed/truncated decrypted values. It also always removed the username+hostname-length prefix from flagged payloads even when the prefix did not match, which could truncate wrong decrypt results.

Test Plan

• uv run --no-sync pytest tests/test_importers_winscp.py tests/test_importers_init.py -q

Fixes #70