[Swift] Enforce read bounds in release builds (assert -> precondition) and add missing guards

[fthomasella]

What

The Swift readers guarded out-of-bounds reads only with assert(), which compiles away in release builds (-O). On buffers from untrusted input that skip (or predate) the verifier, those reads walk silently past the allocation. Additionally, TypedVector.subscript and FlexBuffers getRootChecked had no bounds guard at all (the latter still carries a verifier TODO).

Follows the direction of #9081 ([Swift] Fix verifier accepting truncated scalar vectors (OOB read/write, RCE)) — this closes the remaining unguarded read paths.

Changes

• FlatBuffers/ByteBuffer.swift: read/readSlice/readString read-path asserts → precondition() (enforced in -O); builder/write-path asserts untouched. skipPrefix now guards the prefix read on undersized buffers.
• FlexBuffers/ByteBuffer.swift: same conversion on the read paths.
• FlexBuffers/Reader/TypedVector.swift: subscript guards index < count (was fully unchecked).
• FlexBuffers/Reader/Reference.swift: getRootChecked fails closed on buffers too small to hold any root until a full verifier exists.
• New in-bounds regression tests for every guarded path (ByteBufferBoundsRegressionTests).

Demonstration (Linux, swift 6.0, -O)

// master:  readSlice(0, 64) on a 4-byte buffer:
41 42 43 44 ff ff 00 00 41 00 00 00 …   <- heap-adjacent memory, exit 0
// patched: Fatal error / precondition failure (fail closed)

Full before/after transcripts and the tiny demo program: happy to attach if useful.

Testing

• swift build + full swift test suite pass (89 existing + 4 new tests), swift 6.0 on Linux (CI matrix covers 6.0/6.1/6.2 + Windows + WASM — the guards are plain precondition calls, no platform-specific behavior).
• Release-mode before/after verified 3x: master leaks silently; patched traps.

Notes

• precondition keeps a bounds branch on the hot read path in release. Given [Swift] Fix verifier accepting truncated scalar vectors (OOB read/write, RCE) #9081 established this class as worth fixing in-kernel, I've favored fail-closed over silent OOB; if the perf delta matters for verified-buffer workloads, a follow-up could expose an explicitly-unchecked fast path behind the verifier.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[fthomasella]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

done