Out-of-bounds read for corrupt view offsets in BaseVariableWidthViewVector

### Describe the bug

`ViewVarCharVector`/`ViewVarBinaryVector` store values longer than `INLINE_SIZE` (12 bytes) out of line, encoding a data-buffer index and an offset inline in the view buffer. When a vector is loaded from an IPC stream these fields come straight from the input.

`BaseVariableWidthViewVector` dereferences them verbatim in `getData`, `getDataPointer`, `hashCode`, `copyFromNotNull` and `splitAndTransferViewBufferAndDataBuffer`, e.g.

```java
dataBuffers.get(bufferIndex).getBytes(dataOffset, result, 0, dataLength);
```

Nothing checks that `bufferIndex` is in range or that `dataOffset + dataLength` fits inside the referenced data buffer. A crafted view whose offset/length points past the data buffer produces an out-of-bounds read: with the default bounds checking it throws `IndexOutOfBoundsException`, but with `arrow.enable_unsafe_memory_access=true` (commonly set in production) it reads arbitrary native heap into the returned value.

### Component(s)

Java

從 BaseVariableWidthViewVector 開始，檢查 getData、getDataPointer、hashCode、copyFromNotNull 和 splitAndTransferViewBufferAndDataBuffer 中對 out-of-line view 的處理。比較連結的 pull request，然後驗證損壞的 buffer 索引和 offset/length 範圍不再允許越界讀取，包括啟用 unsafe memory access 的情況。

由索引模型根據 Issue 內容生成。