fix: guard decryptBufferCBC against non-block-aligned ciphertext

[AztecBot]

Summary

PR #21192 added tests expecting decryptBufferCBC to return an empty buffer when given ciphertext whose length is not a multiple of 16 (the AES block size), but did not add the corresponding guard to the implementation. Barretenberg's aesDecrypt processes whatever bytes it can, leading to a non-empty garbage result instead of the expected empty buffer.

Adds an early return of an empty buffer in decryptBufferCBC when data.length is 0 or not a multiple of 16.

Test plan

• yarn workspace @aztec/foundation test src/crypto/aes128/index.test.ts — all 5 tests pass

ClaudeBox log: https://claudebox.work/s/5026ee69dbe528cb?run=1

[AztecBot]

Automatically closing this stale claudebox draft PR (no updates for 5+ days). Re-open if still needed.