Fix out-of-bounds write in BFBS field iteration

[maxvanamersfort]

Summary

• treat field IDs read from BFBS input as untrusted values
• sort field pointers by ID instead of indexing a field-count-sized vector
• reuse the centralized ForAllFields implementation in BaseBfbsGenerator
• add regression coverage for a verifier-accepted BFBS containing field ID 65535

Problem

ForAllFields allocated a vector with object->fields()->size() entries and
then used field->id() as the write index. A structurally valid BFBS can contain
a sparse or oversized field ID, so processing such a schema could write past the
end of that vector.

Fix

Collect the field pointers, sort them by ID, and iterate over the sorted pointers
in forward or reverse order. This preserves the expected order for normal BFBS
schemas without assuming that IDs form a dense range. The duplicate vulnerable
mapping in BaseBfbsGenerator is removed in favor of the centralized helper.

Testing

• reproduced the original out-of-bounds access with libstdc++ assertions enabled
• confirmed the crafted BFBS passes VerifySchemaBuffer
• added a regression test using field ID 65535
• ran the full upstream C++ test suite: ALL TESTS PASSED

Fixes #8950