flatgeobuf: bound geometry ring ends to the xy coordinate count - #7645

What does this PR do?

GeometryReader in src/flatgeobuf/geometryreader.cpp builds a shapeObj from an .fgb feature's coordinates. For a polygon the per-ring end indices come from the geometry's ends() array in the file, and readLineObj() used them to walk m_xy (and the parallel z/m arrays) without checking them against the number of coordinate pairs actually present in xy(). A ring end index past the coordinate count reads past the buffer; readPoint() had the same unchecked indexing. The flatbuffer is not verified, so those sizes are file-controlled.

The reader now records the available coordinate-pair count when xy is read and rejects any ring range that does not fit it (and any z/m array shorter than the requested points) before allocating or copying. Keeping the check in readLineObj/readPoint covers point, line, polygon and the multipoint/multiline/multipolygon variants that all funnel through the same code.

What are related issues/pull requests?

Same neighbourhood as #7545, which bounded the property blob; this covers the geometry-decoding side.

AI tool usage

• AI supported my development of this PR. See our policy about AI tool use. Use of AI tools, if any, must be indicated.

Tasklist

• Make sure code is correctly formatted (cf pre-commit configuration)
• Add test case(s) in /msautotest (follow steps in Regression Testing)
• Add a regression test (tests/unit/test.cpp: decodes a polygon whose ring end exceeds its coordinate count; fails under ASan before the fix, passes after)
• Add documentation
• Review
• Adjust for comments
• All CI builds and checks have passed