TINKERPOP-3281 Reject malformed GraphBinary length prefixes

[GumpacG]

GraphBinary sized heap allocations from an unvalidated 4-byte length prefix before reading the payload, so a tiny
pre-auth frame (~6-21 bytes) could demand gigabytes and OOM Gremlin Server or a connecting driver.

What changed

• Validate each length/count against the bytes actually remaining before it sizes an allocation or bounds a loop;
  reject negative or oversized with IOException.
• Cap eager pre-sizing of growable collections/maps (grow on demand instead).
• Reject truncated length prefixes and negative BulkSet bulk values.
• Covers String, ByteBuffer, BigInteger, InetAddress, list, set, map, Tree, BulkSet, Bytecode, P
  and graph. Well-formed messages are unaffected.

Testing

GraphBinaryLengthPrefixTest (rejection + large round-trip cases); full GraphBinary compatibility suite green.

See: https://issues.apache.org/jira/browse/TINKERPOP-3281

Assisted-by: Kiro: Claude Opus 4.8

[codecov-commenter]

Codecov Report

❌ Patch coverage is 58.06452% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.52%. Comparing base (4722890) to head (bdb4220).
⚠️ Report is 69 commits behind head on 3.7-dev.

Files with missing lines	Patch %	Lines
...tructure/io/binary/types/SimpleTypeSerializer.java	33.33%	4 Missing and 2 partials ⚠️
...lin/structure/io/binary/types/GraphSerializer.java	0.00%	3 Missing ⚠️
...n/structure/io/binary/types/BulkSetSerializer.java	66.66%	1 Missing and 1 partial ⚠️
...tructure/io/binary/types/ByteBufferSerializer.java	0.00%	1 Missing ⚠️
...ructure/io/binary/types/InetAddressSerializer.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             3.7-dev    #3610      +/-   ##
=============================================
+ Coverage      75.49%   75.52%   +0.02%     
- Complexity     13161    13189      +28     
=============================================
  Files           1092     1093       +1     
  Lines          67208    67286      +78     
  Branches        7391     7403      +12     
=============================================
+ Hits           50742    50816      +74     
- Misses         13837    13846       +9     
+ Partials        2629     2624       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kenhuuu]

We should probably throw SerializationException from serializers as that is already a type of IOException