fix: Harden SIMD UTF-8 tail-copy bounds checks (#26797)

## Summary

This PR hardens the SIMD UTF-8 validation tail-copy paths in `third_party/utf8_range`.

The AVX2 and SSE implementations copy the remaining input bytes into fixed-size stack buffers before processing the final partial block. This change makes the copy length explicitly derived from `size_t` input length arithmetic and clamps it to the destination buffer size before `memcpy`.

## Changes
- `third_party/utf8_range/lemire-avx2.c`
- `third_party/utf8_range/lemire-sse.c`
- `third_party/utf8_range/main.c`
- Convert `len` to `size_t` after rejecting negative values.
- Use `src_len` consistently for loop and tail-length calculations.
- Bound the final tail copy to the local buffer size:
  - 32 bytes in the AVX2 path.
  - 16 bytes in the SSE path.
- Add a defensive allocation/copy check in the test helper.

## Security impact

This should be treated as defensive hardening rather than a demonstrated critical vulnerability. The goal is to make the fixed-size tail-buffer invariant explicit and prevent future changes from accidentally turning the tail copy into an out-of-bounds write.

## Verification
- [x] Build passes
- [x] Scanner re-scan confirms fix
- [x] LLM code review passed

---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*

Closes #26797

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/26797 from orbisai0security:fix-fix-v-001-memcpy-buffer-overflow-utf8-range 69f9c2647694ba9ee1930c1ca6ca0ed60bbcf47d
PiperOrigin-RevId: 919700794