fix(pgdriver): guard protocol message sizes against overflow and invalid lengths

[namtzigla]

What

Guards the pgdriver Postgres protocol against message-size integer overflow (write
side) and invalid/negative server-supplied lengths (read side).

Closes #1397.

Why

driver/pgdriver wrote message/parameter length prefixes by casting len() to
uint32/int16 with no bound check. A single query or parameter ≥ 4 GiB wrapped the
length field, desyncing the server — the same integer-overflow → protocol-desync → SQL
injection class as jackc/pgx CVE-2024-27304. bun uses the simple protocol, so an
oversized inlined parameter goes out as one Query message and the wrapped length lets
the server parse attacker bytes as a new frame. Separately, server-supplied lengths were
fed straight into make([]byte, n) / slice expressions, so a malicious or on-path server
could crash the client (negative length → panic) or exhaust memory.

Change

Write side

• writeBuffer records a sticky error when a message (FinishMessage) or parameter
  (FinishParam) would exceed the 32-bit size limit, and Conn.write refuses to send a
  buffer whose message failed to build — so an overflowing message never reaches the wire.
• writeBindExecute rejects > math.MaxInt16 parameters instead of truncating the count.

Read side

• readMessageType rejects a length field < 4 (would produce a negative body length).
• reader.ReadTemp rejects a negative n.
• readColumnValue's default branch treats a non-positive length as NULL rather than
  make([]byte, negative).

Tests

driver/pgdriver/message_size_test.go covers the write guards (the 4 GiB limit is a
test-overridable var so the test needs no multi-GB allocation), the Bind param-count cap,
and the read-side rejections. go build, go vet, gofmt clean; new tests pass. (The two
pre-existing failing tests in this package require a live PostgreSQL and fail identically on
master.)

Notes / scope

The read-side change guards the negative-length panics; a configurable cap for very large
(but positive) server-declared lengths is intentionally left out to avoid breaking legitimate
large result values — happy to add one if preferred.

Reference

• jackc/pgx CVE-2024-27304 / GHSA-mrww-27vc-gghv