fix(parser_data_tamer): bound snapshot lengths before consuming them

[pabloinigoblasco]

Summary

The DataTamer snapshot framing carries two wire-declared uint32 lengths (mask_size, payload_size). parseScalarsImpl consumed both without checking them against the bytes actually remaining in the payload. Two shared primitives make that unsafe on their own:

• Deserialize<T> runs std::memcpy(&var, buffer.data, N) before its N > buffer.size bounds check.
• BufferSpan::trimFront(n) does data += n; size -= n; with no floor, so an oversized n underflows size_t.

An inflated length therefore underflows size and walks the read cursor into a wild pointer → SIGSEGV on 64-bit desktop builds, reachable from any truncated or corrupt DataTamer source (MCAP with a DataTamer schema, or a live ZMQ/MQTT/UDP channel).

Fix: validate each length against the remaining buffer before consuming it, and require the 4 header bytes to be present before each Deserialize<uint32_t>. Reject with PJ::unexpected instead of reading past the end. This is the only bounds check between untrusted wire bytes and the readers, so the guard lives here (the data_tamer dependency is a pinned upstream release).

Why

A single truncated or corrupt DataTamer snapshot crashes the whole application with a wild-pointer read — no bad actor required, just a bag cut mid-write. Same defect class as the ROS2-CDR byte-sequence OOB (#183), in a different parser.

Testing

ctest -R data_tamer — three new regression tests, all rejecting cleanly with no crash:

• OversizedMaskSizeIsRejected — mask_size = 0xFFFFFFFF with only the 4 header bytes present
• TruncatedBeforeMaskSizeIsRejected — payload shorter than the 4-byte header
• OversizedPayloadSizeIsRejected — payload_size = 0xFFFFFFFF with nothing following the mask