RUBY-3869 Validate Binary subtype 0x02 outer/inner length on decode

[comandeo-mongo]

Summary

BSON::Binary.from_bson did not cross-check the outer/inner length fields for subtype 0x02 (:old), and never explicitly rejected negative lengths. Malformed payloads were caught only by incidental effects (the leftover bytes happening to misalign the next-field type byte, or a wrap-around triggering the C get_bytes overrun guard).

This change adds an explicit cross-check (inner_length == outer_length - 4) and an explicit negative-length guard, both raising BSON::Error::BSONDecodeError with a clear message.

What changed

• lib/bson/binary.rb — from_bson now raises on length mismatch and negative length instead of relying on incidental rejection.
• spec/bson/binary_spec.rb — unit specs covering the four error paths (inner too long, inner too short, inner negative, non-old outer negative). The bson-corpus tests assert only that something raises; these tests pin the exact error class and message.

Cross-driver reference

Matches the existing Python driver behavior in bson/__init__.py::_get_binary:

if subtype == 2:
    length2 = _UNPACK_INT_FROM(data, position)[0]
    position += 4
    if length2 != length - 4:
        raise InvalidBSON("invalid binary (st 2) - lengths don't match!")
    length = length2

Test plan

• bundle exec rspec spec/bson/binary_spec.rb spec/spec_tests/corpus_spec.rb — 2613 examples, 0 failures.
• bundle exec rubocop lib/bson/binary.rb spec/bson/binary_spec.rb — no offenses.

Jira

https://jira.mongodb.org/browse/RUBY-3869