refactor(dpi/snmp): collapse find_pdu_type match, drop unreachable Unknown variant

[0xghost42]

What

find_pdu_type gates its PDU-tag lookup with an outer range check, then dispatches inside with a match that includes an Unknown(other) catch-all:

for &byte in data.iter().take(50) {
    if (PDU_GET_REQUEST..=PDU_REPORT).contains(&byte) {
        return Some(match byte {
            PDU_GET_REQUEST => SnmpPduType::GetRequest,
            ...
            PDU_REPORT => SnmpPduType::Report,
            other => SnmpPduType::Unknown(other),  // <-- unreachable
        });
    }
}

The match arms cover all nine consecutive constants 0xA0..=0xA8 explicitly, and the outer contains excludes anything outside that range — so the Unknown(other) arm has no value it can ever match.

Changes

1. Inline the gate into the match. _ => continue skips non-PDU bytes so the loop scans through header noise in a single pass without the redundant contains check.

   let pdu_type = match byte {
       PDU_GET_REQUEST => SnmpPduType::GetRequest,
       ...
       PDU_REPORT => SnmpPduType::Report,
       _ => continue,
   };
   return Some(pdu_type);

2. Drop SnmpPduType::Unknown(u8). With the construction site removed, cargo clippy flags the variant as dead code. The parser never produces it, and the previous Display arm UNKNOWN({}) was only reachable from a code path that didn't exist — deleting it keeps the public type honest about what values it can hold.

Why it matters

• One pass instead of two checks against the same byte.
• The type now matches the parser's behavior: nine known PDU tags, nothing else. If a tenth PDU type ever needs adding (e.g. SNMPv3 Report was a late addition for a reason), the fix lives in the match — there's no Unknown-shaped pretense that we already handle it.
• Removes a clippy::dead_code waiver the codebase didn't actually have but would have needed to silence.

Tests

Added three tests for find_pdu_type that exercise the loop directly:

• test_find_pdu_type_skips_non_pdu_bytes — leading INTEGER (request-ID) bytes followed by PDU_GET_BULK_REQUEST; the scan must skip the noise and land on the tag. This is the real-world v1/v2c layout: community string is parsed by analyze_snmp, then find_pdu_type is handed the remainder which starts with non-PDU bytes.
• test_find_pdu_type_returns_none_when_no_pdu — payload with no PDU tag returns None.
• test_find_pdu_type_caps_search_at_50_bytes — PDU tag at offset 60 must not be found (locks the existing scan cap).

$ cargo test --quiet -p rustnet-monitor snmp
running 9 tests
.........
test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured

$ cargo clippy --all-targets
(clean — including the previously-warned dead-code path)

Full suite stays green (327 passing).

No wire-format behavior change for any input the parser already accepted.

[domcyrus]

@0xghost42 Thanks a lot for your PR. This looks good to me!