A Security Model and Fully Verified Implementation for the IETF QUIC Record Layer