Fix integer truncation and missing NULL checks in upb (#27712)

## Summary

Four hardening fixes for upb internals found during security audit:

1. **compare_unknown.c:122-126 — integer truncation + missing NULL check**: `oldsize` and `newsize` are declared as `int` but hold `size_t * sizeof(...)` products. On 64-bit systems, these truncate to 32 bits, causing incorrect `upb_grealloc` arguments at large field counts (~89.5M unknown fields). Also adds missing NULL check after `upb_grealloc`, using the existing `upb_UnknownFields_OutOfMemory()` longjmp handler.

2. **map_sorter.h/map_sorter.c — same integer truncation pattern**: `_upb_mapsorter` struct fields (`size`, `cap`) and `_upb_sortedmap` fields (`start`, `pos`, `end`) are `int` despite `_upb_Map_Size()` returning `size_t`. Same truncation overflow as #1.

3. **copy.c:41 — missing NULL check before memcpy**: `upb_Clone_StringView` calls `upb_Arena_Malloc` then `memcpy` without checking for NULL. The parallel code path in `upb_Clone_MessageValue` (same file, line 67-69) correctly checks.

4. **array.h:83 — missing overflow check in array allocation**: `_upb_Array_NewMaybeAllowSlow` computes `init_capacity << elem_size_lg2` without overflow guard. The parallel `_upb_Array_Realloc` (`array.c:169-180`) uses `upb_ShlOverflow()`. The combined check `init_capacity > (SIZE_MAX - array_size) >> elem_size_lg2` guards against both shift overflow and the subsequent addition overflow.

## Test plan

- [x] Add `ManyFieldsSortReallocation` test for compare_unknown.c sort buffer reallocation
- [x] Add `ManyFieldsNotEqual` test verifying differing values detected after sorting
- [x] Add `NewOverflowCapacityReturnsNull` test for array.h overflow guard
- [ ] Existing unit tests pass

🔒 Found during security audit of upb internals

Closes #27712

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/27712 from jortles:fix-upb-integer-null-hardening 6cbc9ae985655bde93ba4c3d09d14537d77e4142
PiperOrigin-RevId: 999523263