BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string

BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string

hlua_channel_send_yield() keeps in <l> the number of bytes already pushed
into the channel across yields, and correctly limits the amount it tries
to push next to the remaining "sz - l" bytes. But it always passed the
beginning of the string to _hlua_channel_insert(), so after a partial
write the same prefix was sent again instead of the remainder.

For a Lua script calling Channel:send() with more data than the channel
can currently hold, the peer therefore receives the beginning of the
buffer twice and never sees its tail. Any protocol framing carried over
that stream is silently desynchronized, and the script has no way to
notice since the returned count is correct.

Let's advance the source pointer by the number of bytes already sent, as
the applet send paths do.

This was introduced in 2.5 by commit a1ac5fb28 ("MEDIUM: filters/lua: Be
prepared to filter TCP payloads"). It must be backported to all stable
versions.

Reported-by: Claude (ANT-2026-GQE208VX)