fix: validate ciphertext length in aes128 decryptBufferCBC

[AztecBot]

Summary

Adds input validation to Aes128.decryptBufferCBC to return an empty buffer when ciphertext is empty or not a multiple of 16 bytes (the AES block size).

PR #21192 added tests expecting this behavior but did not update the implementation, causing CI failure on merge-train/spartan.

Fix

Added early return guard in decryptBufferCBC:

if (data.length === 0 || data.length % 16 !== 0) {
  return Buffer.alloc(0);
}

Test plan

• All 5 aes128 unit tests pass locally
• The previously failing test should return empty buffer for ciphertext not a multiple of 16 now passes

ClaudeBox log: https://claudebox.work/s/60f97cca5a40e121?run=1