`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

`ZSTD_seekable_decompress` shortens the requested length to the end of the
data without checking that the offset is before it. For an offset past the
end, it returns a wrapped-around length without writing anything, and
`Seekable::decompress` passed that length to `Vec::set_len`.

With the `seekable` feature, whoever supplies the archive, or chooses the
offset, can leave the caller's `Vec<u8>` with a length far beyond its
capacity. Reading it then discloses neighbouring heap memory, and appending
to it corrupts memory. Offsets near `u64::MAX` can also hang the call.

The flaw was corrected by clamping requests to the end of the data, and by
checking every count reported by the C library against the buffer capacity.