Validate the LMS / HSS private key fields at decode - the HSS level count and index pair, the LMS one-time index and its limit, and the tree cache nodes against their cached children - cross-check a supplied public key against an already-cached root, and stop the single-LMS-key retry in getInstance(byte[]) masking the real parse failure, relates to github #2414.