[Fix vulnerability] Must validate input for decrypt.

There is a possible out of bounds read in Session::decrypt
due to lack of input validation.

Poc test is in http://go/ag/20002511

Test: sts-tradefed run  sts-dynamic-develop  -m StsHostTestCases -t android.security.sts.Bug_244569759#testPocBug_244569759

Bug: 244569759
Change-Id: I493200ba090226b5362d758c5dcc4b81f94d24c0