[sysvshm] Clamp shm_get_var chunk length to segment bounds - #23495

shm_get_var() trusted the sysvshm_chunk->length field read straight from
the shared memory segment and handed it to php_var_unserialize() as the
end bound: a hostile segment claiming a multi-gigabyte length made the
parser read past ptr->end and past the end of the SysV mapping. Reject a
negative or out-of-bounds length with the existing corruption warning and
harden php_check_shm_data() so a chain walk never dereferences a chunk
header that does not fully fit before ptr->end. Sibling audit:
php_remove_shm_data() only memmoves when memcpy_len > 0, which bounds it
to [shm_varpos, old end), and sysvmsg unserializes exactly msgrcv()'s
kernel-bounded byte count, so both are unaffected.