## Bug
`RepeatedField_subarray` (called from `RepeatedField_index` 2-arg form,
`repeated_field.c:270`) loops `i` from `beg` to `beg + len` and calls
`upb_Array_Get(arr, i)` for every value. `upb_Array_Get` only has a
debug-only `UPB_ASSERT` (ruby-upb.c:7182); release builds therefore
perform `memcpy(&ret, data + (i << lg2), 1 << lg2)` for arbitrary `i`,
reading the upb arena out of bounds.
Result: silent heap info disclosure for numeric fields (`repeated int32`
returns adjacent arena bytes as Ruby integers), segfault for
`repeated string`/`message`. Confirmed with ASAN (`use-after-poison`,
READ size 4 at `RepeatedField_subarray:188`).
## Fix
Clamp `len` to `size - beg` in `RepeatedField_subarray`, matching Ruby
`Array#[beg, len]` semantics. Also reject negative `len` and fix the
`rb_ary_new2(size)` capacity hint to use the now-known `len`.
Closes#27191
COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/27191 from vhullto:fix/repeated-field-subarray-oob 876202835c
PiperOrigin-RevId: 917251509
f04511c9c2