google-apis-core: CompositeIO does not maintain the IO read contract

`Google::Apis::Core::CompositeIO` currently leaves `pos` unchanged after reads, returns `nil` for `read(0)`, and decrements remaining length by character count rather than byte count. This diverges from the IO contract and misaccounts multibyte data.

A focused candidate:
- returns an empty buffer for zero-length reads,
- rejects negative lengths,
- advances `pos` and remaining length by `bytesize`.

The focused contract model and 18 targeted examples pass; the cumulative core suite is 509 examples / 0 failures on Ruby 4.0.6. PR #18722 also touches CompositeIO, but only for frozen-string compatibility already present in current source; it does not address these semantics.

I have a minimal patch ready and can submit it after maintainer acceptance per CONTRIBUTING. The source audit and candidate preparation used AI assistance; I reviewed and verified the result.