[C++][Gandiva] Out-of-bounds read in evaluate_return_char_length with malformed pad fill text

### Describe the bug, including details regarding any error messages, version, and platform.

`evaluate_return_char_length` in `cpp/src/gandiva/precompiled/string_ops.cc` sizes the `lpad`/`rpad` output when the fill text is more than one byte wide. It counts the fill glyphs with `utf8_length_ignore_invalid`, which charges an invalid or truncated glyph a single byte, then walks the fill text a second time stepping by the width `utf8_char_length` declares, with no bound on `fill_index`.

The two walks disagree on malformed fill text. For the fill `{0xE0, 'a', 'a'}` the count is 3 glyphs, so the partial-fill loop runs up to twice, while its first step consumes all 3 bytes; the next `fill_text[fill_index]` read is past the end of the fill buffer.

Reachable from `lpad(text, n, fill)` / `rpad(text, n, fill)` where `fill` comes from untrusted string data. With a verbatim copy of the helper under AddressSanitizer and the fill above in an exactly-sized heap buffer, `lpad('ab', 7, fill)` gives:

```
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 ...
0 bytes after 3-byte region
```

Built from `main` (154962c).

### Component(s)

C++ - Gandiva