Fix #484, reject invalid move-target buffers

[sylvesterkaczmarek]

Fixes #484.

Reject null or zero-capacity destination buffers before formatting a move target. Document the return contract and extend the existing regression test for untouched zero-length buffers, null pointers, one-byte capacity, exact fits, and existing truncation behavior.

Validation

Debian 12 arm64, GCC 12.2, native cFE/OSAL, EDS disabled:

• All 14 CF coverage targets passed: 318 cases and 2,349 assertions, repeated 10 times.
• The isolated move-target regression passed 23 assertions across 100 AddressSanitizer/UndefinedBehaviorSanitizer runs, with production source and test code instrumented.
• The zero-capacity regression failed against unchanged upstream code.
• Flight application build, clang-format 19 on changed lines, and git diff --check passed.

The broader CFDP sanitizer run stopped in unchanged CF_CFDP_CopyStringFromLV on a null source pointer. That separate issue is outside this patch; the sanitizer result above is limited to the move-target regression. Full mission/COSMOS, EDS-enabled and hardware testing were not run.

Valid-buffer behavior and public signatures are unchanged.

Contributor: Sylvester Kaczmarek, Personal. No third-party code added. Contributor License Agreement submission status is unverified.