ktls CBC decrypt: Avoid creating zero length iovec entries

If an mbuf's length in the chain for an encrypted TLS record exactly
matches the remaining length of header bytes to skip, skip the mbuf
entirely rather than adding a zero-length iovec entry.

Sponsored by: Chelsio Communications