deserialize: validate offsets for structs, slices, lists (zeam #843)

[ch4r10t33r]

Problem

Peer-supplied SSZ with invalid offset tables could slice past the buffer and panic during deserialize (struct variable fields, variable []T, variable arrays, and utils.List decode). See zeam#843.

Change

• Variable arrays: require minimum length, aligned offset prefix, prefix within buffer, start <= end, monotonic offsets.
• Variable []T: validate first/second offsets, item count, and each subsequent offset read before slicing.
• Structs: bounds-check every fixed-field read and variable-field slice; enforce start <= end, offsets within buffer, monotonicity, and indices[0] == i for the first variable field.
• Unions: require serialized.len >= 1 before reading the selector byte.
• utils.List.sszDecode: fixed-size items reject ragged length and n > N; dynamic path bounds-checks the offset-prefix length before slicing.

Tests / tooling

• Two regression tests for malformed struct payloads.
• build.zig.zon: minimum_zig_version = "0.16.0" (matches CI; satisfies anyzig when present).

Downstream

After merge, zeam can switch from a vendored copy back to a build.zig.zon git+ dependency on the new commit.

[gballet]

Test coverage is too low given the amount of error returns that were added:

┌─────────────────────────────────────────────────────────────────────────────────────┬───────────────────┐
  │                                      Code path                                      │      Tested?      │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ Struct variable-field start > serialized.len (line 634)                             │ ✅ both new tests │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ Struct fixed-field overflow (lines 600/608/612)                                     │ ❌                │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ Struct start > end / start < indices[prev] / first-field start != i (lines 635-637) │ ❌                │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ Variable array path (lines 461-475)                                                 │ ❌                │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ Variable []T slice path (lines 524-558) — incl. the new n_items == 0 rejection      │ ❌                │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ Union 1-byte check (line 645)                                                       │ ❌                │
  ├─────────────────────────────────────────────────────────────────────────────────────┼───────────────────┤
  │ utils.List ragged length + n > N (utils.zig:74-76)                                  │ ❌                │
  └─────────────────────────────────────────────────────────────────────────────────────┴───────────────────┘

[ch4r10t33r]

@gballet I have addressed your comments.