fix(upb): guard array, map reserve, and extension registry against size/shift overflow (#30787)

## Summary

This PR adds overflow and shift-bounds checks across `upb/message` and `upb/mini_table/extension_registry.c`:

1. **`_upb_Array_NewMaybeAllowSlow` and `_upb_Array_TryFastRealloc` (`upb/message/internal/array.h`)**:
   - In `_upb_Array_NewMaybeAllowSlow`, `const size_t elem_bytes = init_capacity << elem_size_lg2;` and the arena pool lookup previously ran *before* checking whether `init_capacity` overflows `size_t` when shifted by `elem_size_lg2`. If `init_capacity = (SIZE_MAX >> elem_size_lg2) + 1` and a 16-byte recycled pool block is present on the arena, `elem_bytes` wraps to `0`, `pool_bytes` becomes `16`, and `_upb_Array_New` returns a non-`NULL` under-sized array (`capacity = 16 >> elem_size_lg2`, e.g. `2` for 8-byte elements) instead of failing with `NULL`. Move and tighten the `init_capacity` upper-bound check (`init_capacity > (max_bytes - array_size) >> elem_size_lg2`) before the shift and pool lookup.
   - In `_upb_Array_TryFastRealloc`, guard `capacity > max_bytes >> elem_size_lg2` before `capacity << elem_size_lg2`.

2. **`upb_Array_Insert` (`upb/message/array.c`)**:
   - `upb_Array_Insert` checked `upb_AddOverflow(arr->UPB_PRIVATE(size), count, &new_size)` only via `UPB_ASSERT(ok)`, which is compiled out under `NDEBUG`. In release builds on a non-empty array, `upb_Array_Insert(arr, 0, SIZE_MAX, arena)` wraps `new_size` below `arr->UPB_PRIVATE(size)`, passes `_upb_Array_ResizeUninitialized`, and calls `upb_Array_Move` with `i + count` out of bounds. Return `false` when `!ok` (matching `upb_Array_AppendAll`).

3. **`_upb_Map_Reserve` (`upb/message/map.c`)**:
   - Guard against `size` addition overflow and `size_lg2 >= 32` before evaluating `(size_t)1 << size_lg2` (which triggers undefined shift behavior when `size_lg2 >= sizeof(size_t) * CHAR_BIT`).

4. **`upb_ExtensionRegistry_AddArray` (`upb/mini_table/extension_registry.c`) and `_upb_Message_Copy` (`upb/message/copy.c`)**:
   - Guard `count * sizeof(*e)` and pointer addition wraparound in `upb_ExtensionRegistry_AddArray` before `UPB_PTRADD(e, count)`.
   - Guard `mini_table->UPB_PRIVATE(size) < sizeof(upb_Message)` before subtracting `sizeof(upb_Message)` in `_upb_Message_Copy`.

## Test Plan

- Added `MessageTest.ArrayMapAndExtensionRegistryOverflow` in `upb/message/test.cc` covering `_upb_Array_New` with a seeded 16-byte arena pool block, `_upb_Array_TryFastRealloc`, `upb_Array_Insert` (`NDEBUG`), `upb_Map_Reserve`, and `upb_ExtensionRegistry_AddArray`.
- Verified with Bazel 8.6.0 and clang 21.1.8 on Linux x86_64: `bazel test //upb/...` (48 test targets) passes under `-c opt`, the default fastbuild configuration, and `--config=asan --config=ubsan`, with `//upb/message:test` run 3 times in each. On unpatched `main` the new test fails in all three configurations.

Related: the `_upb_Array_NewMaybeAllowSlow` bound builds on the check added by #27712. That check runs only on the pool-miss path, after `elem_bytes = init_capacity << elem_size_lg2` has already been computed and used for the pool lookup; this change moves the same bound ahead of the shift and the pool lookup and also reserves `UPB_MALLOC_ALIGN - 1` and the ASan guard size. The other sites (`upb_Array_Insert`, `_upb_Array_TryFastRealloc`, `_upb_Map_Reserve`, `upb_ExtensionRegistry_AddArray`, `_upb_Message_Copy`) are not touched by #27712 or by the earlier `_upb_Array_Realloc` PRs (#26373, #26534, #27568).

Closes #30787

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/30787 from professor-moody:fix-upb-array-map-extreg-overflow-guards 5c6cb3354601b6b1433abba09944ecaaffae6aa6
FUTURE_COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/30787 from professor-moody:fix-upb-array-map-extreg-overflow-guards 5c6cb3354601b6b1433abba09944ecaaffae6aa6
PiperOrigin-RevId: 1014041046