Fix Data Channel encryption downgrade via BUNDLE desync in kPrAnswer.

Update BundleManager::Update to establish BUNDLE groups when receiving
a prAnswer. This fixes a desync where VerifyCrypto (which uses the
BUNDLE group from the SDP) assumed sections were bundled and skipped
fingerprint checks, while JsepTransportController (which uses
BundleManager) did not bundle them, leading to separate unencrypted
transports if a fingerprint was missing in the prAnswer.

Includes a regression test that MUNGEs a prAnswer to trigger this
condition and verifies that no unencrypted packets are received.

Bug: webrtc:504579798
Change-Id: I8b1b3a20f6c82f6be5c79d636be230fbbc83ca08
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/465400
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Auto-Submit: Harald Alvestrand <hta@webrtc.org>
Reviewed-by: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#47493}