fix(puffin): return DataInvalid instead of panicking on malformed footer length

[arpitjain099]

What changes are included in this PR?

FileMetadata::read locates the footer by subtracting from the file size, but never checks the file is big enough first. Two subtractions can underflow:

• read_footer_payload_length does input_file_length - FOOTER_STRUCT_LENGTH, so any file shorter than 12 bytes underflows.
• read_footer_bytes does input_file_length - footer_length, where footer_length is derived from footer_payload_length, the u32 read out of the FooterPayloadSize field of the file being parsed. A file that declares a payload larger than itself underflows here.

In debug builds both panic with "attempt to subtract with overflow". In release the subtraction wraps and you get a bogus read range instead.

Worth saying up front: I'm treating this as robustness, not a security issue. Puffin files are table statistics written by the engines that already write the table, so I'm not claiming a meaningful trust boundary. The point is narrower - a truncated or corrupt file should surface as a DataInvalid error, the way the magic checks and the bounds checks in decode_flags / extract_footer_payload_as_str already do in this same file, rather than panicking on the caller.

The fix adds a MIN_FILE_LENGTH check in read and switches the second subtraction to checked_sub, both returning ErrorKind::DataInvalid.

I left read_with_prefetch alone. Its prefetch_hint > 16 and prefetch_hint <= input_file_length guards already keep its own slicing in range, and when the declared footer is larger than the hint it falls back to read, which is now checked.

Are these changes tested?

Two unit tests, one per case. Both panic before the fix:

thread 'puffin::metadata::tests::test_file_shorter_than_minimum_length_returns_error'
panicked at crates/iceberg/src/puffin/metadata.rs:201:21:
attempt to subtract with overflow

thread 'puffin::metadata::tests::test_footer_payload_length_larger_than_file_returns_error'
panicked at crates/iceberg/src/puffin/metadata.rs:218:21:
attempt to subtract with overflow

After the fix, cargo test -p iceberg --lib puffin gives 39 passed, 0 failed. Full crate cargo test -p iceberg --lib is 1444 passed, 0 failed, and cargo clippy -p iceberg --all-targets is clean.