fix(arrow-scalar): bound the lengths read while decoding a scalar

[jackylee-ch]

Three lengths in the scalar encoding come from varints and can reach u64::MAX, and none were checked against the bytes present. ArrowScalar::decode panics on all three:

fmt_len     = u64::MAX -> panic  slice index starts at 10 but ends at 9
num_buffers = u64::MAX -> panic  capacity overflow
buffer_len  = u64::MAX -> panic  slice index starts at 14 but ends at 13

The two length fields computed offset + len, which wraps and so slips past the very comparison meant to bound it. The buffer count was reserved for before anything validated it.

Resolve each run's end through a checked add, and reject a count larger than the remaining bytes.

[lance-gatekeeper]

⚠️ Gate recommendation: approve with a non-blocking risk.

The checked endpoints and pre-allocation count bound correctly turn the three reported extreme length/count fields into errors without changing valid encodings.

A pre-existing malformed-type path remains: the self-described null type w:-1 still reaches Arrow’s infallible null allocator and panics. This PR neither introduces nor widens that path, so no change is requested here; follow-up hardening should validate parsed data types before null construction.