[php-src] PR #23496: [mysqlnd] Fix result set field metadata length buffer over-read

Pull Request: https://github.com/php/php-src/pull/23496 Author: iliaal In php_mysqlnd_rset_field_read(), a hostile server can place a length marker at the end of a metadata packet whose value exceeds the remaining payload, advancing p past header.size and the command buffer and attaching attacker-controlled lengths to pointers outside the packet that feed memcpy(). Metadata strings now bail out once p leaves the payload and reject lengths beyond the remaining bytes. No other READ_RSET_FIELD users exist and the trailing default-value check never dereferences its length. A hostile-server phpt fails unpatched with an extra protocol-length warning and passes patched.