Harden Parser::Deserialize and reflection verification input contracts

[Grolar1337]

Four hardening fixes, each with regression tests, on a clean branch from
master (5761d6e). This PR is independent of fix/reflection-union-verify
(VerifyUnion); it does not touch VerifyUnion / union tag handling.

Commits

1. f7863f44 Harden Parser::Deserialize entry: validate buffer length before identifier reads
   Length validation before identifier reads (fixes a reported OOB read — VRP report).
2. 5bf610f5 Fix Parser::Deserialize double-free on duplicate .bfbs names (objects/enums/services loops)
   SymbolTable ownership on Deserialize error paths (fixes a reported double-free — VRP report).
3. dd30a3a2 Validate base_type/element range in Type::Deserialize
   Fuzzer-found: prevents SizeOf()'s default case with out-of-range wire values.
4. 876a5aa0 VerifyObject: reject None-typed fields instead of asserting
   Fuzzer-found: return false instead of assert.

Fixes (3) and (4) close issues found by a local fuzz target being upstreamed
(separate PR).

Summary of changes

File	Change
src/idl_parser.cpp	Parser::Deserialize(buf,size): reject size < FLATBUFFERS_MIN_BUFFER_SIZE before identifier reads (commit 1); Parser::Deserialize(Schema*): pop_back() from owning SymbolTable vec before delete on duplicate in the objects/enums/services loops (commit 2); Type::Deserialize: reject base_type/element outside 0..18 before the static_cast (commit 3)
include/flatbuffers/idl.h	unchanged (SymbolTable::Add keeps its original behavior)
src/reflection.cpp	VerifyObject: reflection::None-typed field → return false instead of FLATBUFFERS_ASSERT (commit 4)
tests/reflection_entry_security_test.cpp	new regression test file (grows one test per commit, bisect-clean)
tests/reflection_test.h, tests/test.cpp, CMakeLists.txt	register ReflectionEntrySecurityTest()

Fix details

1 — entry length check. Parser::Deserialize(const uint8_t*, size_t)
called BufferHasIdentifier (a 4-byte strncmp at buf + 4/8) before any
length validation. A short attacker-supplied buffer (10 bytes) made strncmp
read past the heap allocation (ASan: heap-buffer-overflow READ of size 1).
Now size < FLATBUFFERS_MIN_BUFFER_SIZE is rejected up front.

2 — Deserialize double-free. SymbolTable::Add appends before its
duplicate check; on a duplicate the Deserialize error paths deleted an
element still present in the owning vector, and ~SymbolTable freed it again.
On each Add()==true failure path we pop_back() the element (Add appended
it last) before delete. The services loop now distinguishes a failed
ServiceDef::Deserialize (never registered, plain delete) from a duplicate
Add (pop then delete). SymbolTable::Add itself is unchanged, so no other
caller changes behavior.

3 — base_type range. Type::Deserialize cast the wire base_type/
element (a signed byte, values 0..18 valid) with an unchecked
static_cast; out-of-range values (e.g. MaxBaseType == 19, negatives)
reached SizeOf()'s FLATBUFFERS_ASSERT(0) default in debug, or wrong size
metadata in release. Out-of-range values are now rejected before the cast.

4 — None-typed field. VerifyObject asserted on a field whose
base_type == reflection::None (impossible in a valid schema, but craftable
through VerifySchemaBuffer). Now treated as a verification failure
(return false).

Verification

Debug / ASan (UAF + double-free focus), detect_leaks=0

cmake -S . -B build -DFLATBUFFERS_BUILD_TESTS=ON -DCMAKE_BUILD_TYPE=Debug \
  -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
cmake --build build --target flattests -j$(nproc)
ASAN_OPTIONS=detect_leaks=0 ./build/flattests

Output (relevant lines):

EntryLengthValidationTest
SymbolTableOwnershipTest
OutOfRangeBaseTypeTest
NoneFieldVerifyTest
ReflectionEntrySecurityTest: PASSED
ALL TESTS PASSED

No use-after-free / double-free reported by ASan. (LSAN with
detect_leaks=1 reports a pre-existing 48-byte leak in
CrossNamespacePackTest that is also present on pristine master
(verified in a master worktree); it is unrelated to this PR.)

Release (-DNDEBUG, default CMake Release)

cmake -S . -B build-rel -DFLATBUFFERS_BUILD_TESTS=ON -DCMAKE_BUILD_TYPE=Release
cmake --build build-rel --target flattests -j$(nproc)
./build-rel/flattests

Output:

...
ReflectionEntrySecurityTest: PASSED
ALL TESTS PASSED

Regression behavior (pre-fix vs post-fix)

• 10-byte buffer to Parser::Deserialize: pre-fix ASan heap-buffer-overflow
  in strncmp; post-fix returns false, no crash.
• Duplicate-name .bfbs to Parser::Deserialize: pre-fix heap double-free at
  ~Parser; post-fix returns false, no crash.
• base_type out-of-range (MaxBaseType=19) crafted Type: pre-fix
  FLATBUFFERS_ASSERT(0) in SizeOf (debug); post-fix Deserialize returns
  false.
• None-typed field verified via reflection::Verify: pre-fix
  FLATBUFFERS_ASSERT in VerifyObject; post-fix returns false.

PR body notes for maintainers

• Signed-off-by present on all four commits (CLA signed).
• Branch: harden/deserialize-input-contract (from master 5761d6e).
• reflection_verify_fuzzer harness used for fuzzing is being upstreamed in a
  separate PR; not included here.