pcapng: stop copying the unread option buffer for every option

[KernelClint]

Each parsed pcapng option sliced the remaining unread metadata, so a capture holding many small
valid options made rdpcap() cost time quadratic in the option count. The frames need not be
large — the files below hold one 34-byte Ethernet/IP frame and the rest is capture metadata.

A 524,408-byte file with 65,536 comments took 251 ms to read, while an equal-size file with eight
comments took under a millisecond. Doubling the file took 1.24 s.

This walks the buffer by offset instead of reslicing it. A five-point growth run is classified
linear after the change, and a valid-option benchmark went from 13,458.4 to 9,185.9 ns/call.

Test added in test/regression.uts, using valid one-byte comments. It fails whenever the parser
copies a shrinking unread suffix.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.59%. Comparing base (1f87020) to head (a38a284).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5103      +/-   ##
==========================================
+ Coverage   79.42%   80.59%   +1.16%     
==========================================
  Files         372      390      +18     
  Lines       96507    96858     +351     
==========================================
+ Hits        76652    78059    +1407     
+ Misses      19855    18799    -1056     

Files with missing lines	Coverage Δ
scapy/utils.py	72.59% <100.00%> (-0.12%)	⬇️

... and 302 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.