Fix bounds check in CacheVC::scanObject

[traeak]

Fix bounds check in CacheVC::scanObject, requires on disk corruption.

The prior check compared doc->data() - buf->data() against io.aiocb.aio_nbytes cast to int. The pointer arithmetic could wrap when doc->hlen (read from disk) was very large, and the int cast truncated size_t buffer sizes, so the check could pass while doc->hdr() and the subsequent HTTPInfo::unmarshal walked memory past the I/O buffer.

Re-express the check in the unsigned size_t domain and validate doc->hlen directly against the bytes remaining after the Doc header, guarding each subtraction so it cannot underflow.

[Copilot]

Pull request overview

This PR hardens cache object scanning in CacheVC::scanObject by rewriting a bounds check to avoid signed overflow/truncation and ensuring doc->hdr() / HTTPInfo::unmarshal cannot walk past the end of the AIO read buffer when doc->hlen is corrupt or maliciously large.

Changes:

• Replace the prior pointer-difference/int-cast bounds check with size_t-domain validation.
• Add guarded subtractions to ensure Doc header and doc->hlen fit within the bytes remaining in the read buffer before unmarshalling.