sae: check group number on UNSUPP_FINITE_CYCLIC_GROUP

Hostapd has now been updated to include the group number when rejecting
the connection with UNSUPP_FINITE_CYCLIC_GROUP. We still need the existing
len == 0 check because old hostapd versions will still behave this way.

src/sae.c

@@ -758,6 +758,8 @@ static bool sae_verify_committed(struct sae_sm *sm, uint16_t transaction,
 		 */
 		if (len == 0)
 			l_warn("AP did not include group number in response!");
+		else if (len >= 2 && (l_get_le16(frame) != sm->group))
+			return false;
 
 		sm->group_retry++;