perf_hooks: validate import normalization offset

[mcollina]

perf_hooks: validate import normalization offset

The CBOR importer accepts a normalizing_index_offset outside the range
of the allocated counts array. normalize_index() in hdr_histogram.c
applies at most one wrap adjustment of +/-counts_len, so an arbitrary
offset can remain out of bounds and a later record() performs an
out-of-bounds native write in counts_inc_normalised().

Reject offsets not representable as int32_t when reading the CBOR
field, and reject offsets outside [0, counts_len) after the histogram
is reconstructed. Adds regression tests for the boundary at
counts_len, offsets beyond it, and non-int32_t values.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.17%. Comparing base (6f41e41) to head (527f21f).
⚠️ Report is 104 commits behind head on main.

Files with missing lines	Patch %	Lines
src/histogram.cc	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65950      +/-   ##
==========================================
- Coverage   90.17%   90.17%   -0.01%     
==========================================
  Files         770      771       +1     
  Lines      264483   265488    +1005     
  Branches    50262    50472     +210     
==========================================
+ Hits       238491   239396     +905     
- Misses      16981    17044      +63     
- Partials     9011     9048      +37     

Files with missing lines	Coverage Δ
src/histogram.cc	84.80% <66.66%> (-0.04%)	⬇️

... and 91 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.