main
pe-binary: bound section data against file size, cap UKI zero-padding hash, validate optional header size