cmcp_verify.tcg_event_log: _parse_spec_id and parse_event_log accept duplicate algorithm IDs, mismatched digest sizes for known algorithms, and trailing Spec ID bytes #812

Summary

1. _parse_spec_id in src/cmcp_verify/tcg_event_log.py accepts duplicate alg_id declarations, digest_size == 0, and wrong digest_size values for known algorithms (ALG_SHA1, ALG_SHA256, ALG_SHA384, ALG_SHA512), allowing a crafted Spec ID header to declare e.g. ALG_SHA256 with digest_size = 4.
2. _parse_spec_id does not validate the trailing vendorInfoSize byte and vendorInfo length (offset + 1 + vendor_info_size == len(event_data)).
3. parse_event_log accepts duplicate alg_id entries within a single TCG_PCR_EVENT2 digest list (silently overwriting earlier digests for the same algorithm) and does not reject non-bytes data.