A forged iterator makes the script and segment calls reach outside it #263

The family conventions (.github v0.0.50, Rawframe-Project/.github#119) now say that opaque state only the library writes is checked by its cookie, and by every index, slot and length in it being in bounds, so that no bit pattern makes a call read outside the state or the data it names.

muniScriptIterator and muniSegmentIterator carry no cookie, and the calls that take them back trust the lengths and flags inside. Filled with one byte value and passed to the iterator calls, they go wrong in an AddressSanitizer and UBSan build at main 3560659:

• A muniScriptIterator of 0x41 bytes: muniScriptIterator_NextRun reaches muniCursorPeekSlow (src/cursor.c:40), which copies pendingCount (65) bytes into its 4-byte window on the stack: a stack buffer overflow, a write.
• A muniScriptIterator of 0x02 or 0x04 bytes: a load of an invalid bool at src/cursor.c:50.
• A muniSegmentIterator of 0x04 bytes: a load of an invalid bool at src/segmenter.h:263.

The overview currently places an iterator that was never initialized outside the promise, but the family rule asks that no bit pattern reach outside the state: a cookie that refuses an iterator the library did not initialize, and a bounds check on every count and index the calls read (pendingCount, position against length, the bracket and override counts, the kind and phase), with the flags read as bytes and checked.

The script iterator's state has no uint64_t to spare on 64-bit targets (its static_assert), so a cookie there grows muniScriptIterator, which 1.x allows in a minor release.