fix(security): validate SetItemInSlotPacket targets MFFS ghost slots only

[Sweizeur]

Summary

SetItemInSlotPacket (mffs:set_slot_item) accepts any slot index and ItemStack from the client and writes it into the player's currently open container menu without validation. A modified client can target player inventory slots (e.g. while InventoryMenu is open) and inject arbitrary items.

This patch restricts the handler to MFFS ghost filter slots only, matching the legitimate JEI usage in BasicGhostIngredientHandler.

Impact

• Severity: Critical
• Effect: Arbitrary item give (self) on dedicated servers
• Affected version: mffs-5.4.27.jar (Minecraft 1.21.1 / NeoForge), used in the All the Mods 10 modpack

Legitimate usage

The packet is sent from BasicGhostIngredientHandler when dragging JEI ingredients onto SlotInventoryFilter slots in MFFS screens (FortronMenu subclasses).

Fix

In SetItemInSlotPacket.handle():

1. Server-side only (!ctx.flow().isClientbound())
2. Require open menu to be a FortronMenu
3. Validate 0 <= slot < menu.slots.size()
4. Require target slot to be a SlotInventoryFilter

Reproduction

1. Join a server with MFFS 5.4.27
2. Send mffs:set_slot_item with a player inventory slot index and an arbitrary ItemStack while any container is open
3. The item appears in the targeted inventory slot without going through normal give/creative commands