dtls: defer oversized poll outputs

[zRedShift]

poll_output currently assumes the caller-provided buffer is large enough for
queued packets, queued application data, and peer-certificate events. If the
buffer is too small, those paths can panic instead of letting the caller grow
the buffer and retry.

This makes oversized output return Output::BufferTooSmall { needed } without
dropping the pending item. A later call with a large enough buffer emits the
same packet/event/data.

Line delta:

area	added	removed
non-test code	178	76
tests	334	22
docs/changelog	5	0
total	517	98

Validation:

• cargo fmt --check
• git diff --check
• git diff --check upstream/main...HEAD
• /home/ronen/.codex/skills/dimpl/scripts/check-snowflake-local.pl upstream/main
• focused DTLS 1.2 / DTLS 1.3 / auto small-buffer regressions
• cargo test --all-targets --features rcgen
• cargo clippy --all-targets --features rcgen -- -D warnings
• cargo test --no-default-features --features rust-crypto
• cargo clippy --no-default-features --features rust-crypto -- -D warnings
• cargo test --doc --features rcgen