OSSL_CMP_validate_msg(): make sure to reject protection type mismatch