only check the SCID for Initial packets

[marten-seemann]

This fixes a bug where we immediately use the DCID from the preferred address transport parameter during the handshake, and then reject incoming Handshake packets that use this CID as SCID.

There's no need to validate the SCID of Handshake packets, as Handshake packets are authenticated and thus can't be injected by an attacker. The spec only requires this check for Initial packets:

if subsequent Initial packets include a different Source Connection ID, they MUST be discarded.

[codecov]

Codecov Report

Merging #2857 into master will decrease coverage by 0.00%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #2857      +/-   ##
==========================================
- Coverage   85.67%   85.67%   -0.00%     
==========================================
  Files         134      134              
  Lines        9087     9086       -1     
==========================================
- Hits         7785     7784       -1     
  Misses        960      960              
  Partials      342      342              

Impacted Files	Coverage Δ
session.go	77.22% <100.00%> (-0.02%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 272229a...337e217. Read the comment docs.