validate BSON document size against the bytes read

[Angadi56]

The BSON reader takes the document length from the int32 at the start of every document and array, but never checks it. Parsing is driven entirely by the trailing 0x00, so the declared length is read into a local and discarded. That lets a nested document claim a length that disagrees with where its terminator actually falls: an embedded document can declare far more bytes than it holds, terminate early, and the elements that its length said belonged to it get read as members of the enclosing document instead. On an embedded size of FF FF FF 7F in front of {"a":null} and then an "h" field, from_bson returns {"d":{"a":null},"h":true} where a length-aware parser rejects the input, so two BSON readers disagree on the shape of the same bytes. I found it while lining the BSON path up against the other decoders, which all validate their length fields. The fix records the offset before the size prefix and, once the element list and its terminator are read, checks that the bytes consumed match the declared size, in both parse_bson_internal and parse_bson_array. A negative or below-minimum size is caught by the same comparison, since at least the 5-byte minimum is always read.

• The changes are described in detail, both the what and why.
• If applicable, an existing issue is referenced.
• The Code coverage remained at 100%. A test case for every new line of code.
• If applicable, the documentation is updated.
• The source code is amalgamated by running make amalgamate.