GH-1317: bound FlightData frame field length before allocating - #1318

What's Changed

ArrowMessage.frame is the DoPut/DoExchange request marshaller, and for each FlightData field it allocates a buffer sized by a length prefix taken straight off the wire before reading any content, so a client can force an arbitrarily large allocation with a tiny frame (an unauthenticated denial of service during request deframing). The descriptor and header paths use new byte[size], which allocates on the JVM heap and bypasses the BufferAllocator limit entirely. A field can never be longer than the bytes still buffered for the message, so checkFieldLength now rejects a negative or over-long size against stream.available() at all four allocation sites before anything is allocated.

Concretely, a ~10-byte HEADER frame whose length prefix encodes 0x7FFFFFFF drives a new byte[2147483647] (2 GiB) heap allocation before the subsequent read fails; with the check it is rejected in O(1) with no allocation. The added test asserts a field declaring more bytes than the frame contains is refused, and that a well-formed field still parses.

Closes #1317.