ax(ueps): add usage-example comment on default HMAC coverage path

AX Principle 2 — comments as usage examples. The default switch case in
ReadAndVerify silently included unknown extension tags in signedData with
no explanation of why; added a concrete comment showing the pattern and
the security rationale (tag-injection prevention).

Co-Authored-By: Charon <charon@lethean.io>

pkg/ueps/reader.go

@@ -87,6 +87,8 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
 		case TagHMAC:
 			signature = tagValue
 		default:
+			// Unknown extension tags are included in HMAC coverage to prevent tag-injection attacks.
+			// signedData.Write(extensionTLV) — forward-compatible: new tags are authenticated, not silently dropped.
 			signedData.WriteByte(tagByte)
 			signedData.WriteByte(byte(tagLength))
 			signedData.Write(tagValue)