serde_bser/mincode: validate wire-supplied lengths before indexing

[rootkiller6788]

Summary

Closes #1417.

Both serde_bser (Watchman's BSER codec) and mincode take a length from the encoded data and use it to index into a buffer without validating it against the remaining input, so malformed/truncated payloads panic instead of returning a deserialization error.

serde_bser

• Bunser::read_bytes casts a signed wire length straight to usize. A negative length (e.g. BSER_INT8 = -1) becomes usize::MAX, making the slice reader overflow on index + len (debug: attempt to add with overflow; release: inverted-range slice panic) and making the stream reader call scratch.resize(huge, 0) (capacity overflow). The fix rejects len < 0 in read_bytes with a new Error::DeNegativeLength variant.
• IoRead::next_bytes grew the scratch buffer to the full wire length up front. The fix grows it in bounded 4 KiB chunks, so a declared length far larger than the stream yields an EOF error instead of a capacity-overflow panic.

mincode

• Deserializer::read_slice called split_at(len) with a VLQ length read from the data; a length larger than the remaining buffer panicked with mid > len. It now returns an error.
• deserialize_char indexed self.bytes[0] without checking for an empty buffer and sliced &self.bytes[..width] with width taken from the UTF-8 lead byte without checking the remaining length. Both paths now return an error.

Test plan

• cargo test in watchman/rust/serde_bser (15 pre-existing + 2 new tests pass, debug and release).
• cargo test in eden/scm/lib/mincode (1 pre-existing roundtrip + 3 new tests pass).
• New tests cover: negative bytestring length (slice + stream readers), oversized string length, empty char, truncated multi-byte char.

[meta-codesync]

This pull request has been imported. If you are a Meta employee, you can view this in D116931726. (Because this pull request was imported automatically, there will not be any future comments.)

[rootkiller6788]

The PR has been imported internally as D116931726.
Please let me know if any changes are needed, I will update my branch accordingly.