fix oob read on malformed length field in dba flatfile handler

[alhudz]

A flatfile opened read-only parses an attacker-controlled record length, and a negative value overruns the read buffer.

1. num is a size_t but is assigned from atoi(buf), so a length line of -1 becomes SIZE_MAX.
2. the grow step then does buf_size = num + FLATFILE_BLOCK_SIZE, which wraps to a tiny value and erealloc shrinks buf.
3. php_stream_read(dba->fp, buf, num) then reads the rest of the file (num is still SIZE_MAX) into the small buffer.

repro: file_put_contents('x', "-1\n" . str_repeat('A', 200000)); $db = dba_open('x', 'r', 'flatfile'); dba_firstkey($db);
expected: bool(false)
actual: zend_mm_heap corrupted (SIGABRT)

Reachable from dba_firstkey/dba_nextkey/dba_fetch/dba_exists/dba_delete. The same idiom is repeated in flatfile_delete, flatfile_findkey, flatfile_firstkey and flatfile_nextkey, so the guard goes in each. Added a regression test.