Crafted archives can cause a use-after-free during deserialization

Insufficient archive range validation could allow a crafted archive to reach
`ArchivedString::deserialize` with an invalid pointer. A reported reproducer
used `rkyv::from_bytes` to deserialize a struct containing strings, a vector,
a box, and an optional hash map. AddressSanitizer detected a heap use-after-free
during string deserialization.

The flaw could be triggered through the safe checked deserialization API when
processing malicious archive bytes. Version 0.8.17 rejects the malformed
archive during validation. Users who process untrusted archives should upgrade
to 0.8.17 or later.