validate shape ids when decoding S2ShapeIndexCell

[sayed0200]

S2ShapeIndexCell::Decode guards decoded shape ids against INT32_MAX but not against num_shape_ids, so an encoded index whose cell references a shape id past the end of the index decodes without error. The index.shape(clipped.shape_id()) lookup that essentially every query performs while walking the index then indexes shapes_ out of bounds:

==ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 8 ...
  index.shape(5000) -> shapes_[5000]   (shapes_.size() == 2)

Reproduced by hand-encoding a one-cell index whose clipped shape carries shape id 5000, decoding it with a 2-shape ShapeFactory, and reading the referenced shape. The added regression test decodes the same blob and expects Init to reject it.

The fix rejects out-of-range shape ids inside the decode loop, next to the existing INT32_MAX guard.

[gemini-code-assist]

Code Review

This pull request introduces validation to reject out-of-range shape IDs during decoding in S2ShapeIndexCell::Decode, preventing potential out-of-bounds reads, and adds a corresponding unit test. The reviewer recommends validating the shape_id immediately after it is updated in each branch of the conditional block, rather than at the end of the loop, to prevent implicit narrowing conversions of unvalidated values when calling clipped->Init.

[gemini-code-assist]

While this check successfully prevents out-of-bounds access during queries, clipped->Init(shape_id, ...) is called earlier in the loop body before this validation occurs. Since shape_id is an int64_t and clipped->Init expects an int32_t, an extremely large shape_id from malformed encoded data could trigger an implicit narrowing conversion of an unvalidated value before the check is reached.\n\nTo improve robustness and adhere to defensive programming practices, consider validating shape_id immediately after it is updated in each of the three branches of the if-else statement (i.e., right before clipped->Init is called), rather than waiting until the end of the loop.