decode

Decodes exactly one value; truncated data, trailing bytes, and unknown tags are rejected.