kx_advertised: every message after the exchange, not the first alone

The contract named the server's first message after the key exchange. That
frame sits at a position an attacker needs no key to find, so one who had
lowered the advertisement in the clear only had to drop it to be rid of
the check for the whole session. With every message carrying the echo,
being rid of it means dropping them all, which is a plain DoS.

The client already kept the check armed until an echo arrived; this is the
wording the server side is written to.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab

src/stream.rs

@@ -100,7 +100,7 @@ impl Stream {
         }
     }
 
-    /// Refuse the stream if the server's first encrypted message says it advertised a key
+    /// Refuse the stream if an encrypted message from the server says it advertised a key
     /// exchange version other than `seen`, the one this side received in the clear.
     #[inline]
     pub fn check_kx_advertised(&mut self, seen: u32) {