`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

Summary

`ZSTD_seekable_decompress` shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and `Seekable::decompress` passed that length to `Vec::set_len`.

With the `seekable` feature, whoever supplies the archive, or chooses the offset, can leave the caller's `Vec<u8>` with a length far beyond its capacity. Reading it then discloses neighbouring heap memory, and appending to it corrupts memory. Offsets near `u64::MAX` can also hang the call.

The flaw was corrected by clamping requests to the end of the data, and by checking every count reported by the C library against the buffer capacity.