[koekiebox]

moov-io/bertlv can panic on malformed input, and we parse untrusted payloads such as decrypted SRED data. This PR replaces it with our own parser in tlv/ber.go, written against EMV Book 3 Annex B and ISO 8825-1.

OpenEMV served as a reference only and is not a dependency.

What’s in it

• API: Decode, Encode and FindFirstTag. They never panic and return typed errors (*DecodeError{Offset, Err}, which work with errors.Is and errors.As).
• Rejected input:
  • truncated tags, lengths or values
  • indefinite (0x80) and reserved (0xFF) length forms
  • lengths over 4 bytes
  • tags over 4 bytes
  • nesting deeper than MaxDepth (16)
  • input larger than MaxInputSize (64 KiB)
• EMV padding: 00 bytes between TLVs are skipped. FF is not treated as padding.
• No data in errors: error messages carry only the offset, so a misframed PAN never ends up in logs.
• Encode guarantee: Encode checks the depth and size limits, and a raw value under a constructed tag must decode, so whatever we encode we can decode again.
• FindFirstTag fix: it now searches depth-first, which fixes moov’s bug of missing tags that come after a template.
• ValidateAmount: now uses the new parser.
• Dependencies: moov-io/bertlv is removed from go.mod.