verifier: bounds check start offset in VerifyBufferFromStart and prevent overflow in VerifySizePrefixedBuffer

[filtede98]

Summary

This PR addresses boundary checking and overflow safety in the core flatbuffers::Verifier:

1. Bounds Check start Offset in VerifyBufferFromStart():
   When verifying buffers that start at an offset (such as size-prefixed buffers where start = sizeof(SizeT) or custom offsets), VerifyBufferFromStart() previously checked:

   if (!Check(size_ >= FLATBUFFERS_MIN_BUFFER_SIZE)) return false;
   if (identifier && !Check((size_ >= 2 * sizeof(flatbuffers::uoffset_t) &&
                             BufferHasIdentifier(buf_ + start, identifier)))) {
     return false;
   }

   Checking size_ >= ... without accounting for start did not guarantee that the remaining buffer starting at buf_ + start has sufficient length. When verifying a buffer with an identifier where start > 0, BufferHasIdentifier(buf_ + start, identifier) reads bytes up to buf_ + start + 2 * sizeof(uoffset_t). If the remaining buffer after start is smaller than 8 bytes, this could read past the end of the buffer.

   We now validate that start <= size_ && size_ - start >= FLATBUFFERS_MIN_BUFFER_SIZE and that start <= size_ && size_ - start >= 2 * sizeof(flatbuffers::uoffset_t) before calling BufferHasIdentifier().

2. Prevent Integer Overflow in VerifySizePrefixedBuffer():
   In VerifySizePrefixedBuffer(), the check:

   Check(ReadScalar<SizeT>(buf_) + sizeof(SizeT) <= size_)

   could wrap around if ReadScalar<SizeT>(buf_) is close to the integer maximum (e.g. SIZE_MAX). We change this to:

   Check(ReadScalar<SizeT>(buf_) <= size_ - sizeof(SizeT))

   which is immune to integer overflow since Verify<SizeT>(0U) already guarantees sizeof(SizeT) <= size_.

3. Macro Precedence in base.h:
   Wrapped the FLATBUFFERS_MIN_BUFFER_SIZE macro expression in parentheses to avoid operator precedence hazards when used in composite expressions.

4. Unit Tests:
   Added assertions in SizePrefixedTest() in tests/monster_test.cpp verifying that truncated size-prefixed buffers and boundary offsets are safely rejected.