mod_dav_fs: bound lock record fields to the fetched datum length

[arshsmith1]

dav_fs_load_lock_record() in modules/dav/fs/lock.c only checks offset < val.dsize once per top-level record, then reads each field of a fetched lock-database datum without confirming it fits; in the indirect-lock branch it reads ip->key.dsize out of the record and passes it straight to apr_pmemdup(p, val.dptr + offset, ip->key.dsize), so a truncated or corrupt record drives a read of attacker-influenced length past the end of the datum (the owner/auth_user apr_pstrdup() calls can walk past it too). The function already returns DAV_ERR_LOCK_CORRUPT_DB for an unknown type byte, but only after these reads happen. This adds a per-field size check (and a memchr NUL-termination check for the owner/auth_user strings) that routes short records to that same corrupt-DB error before any read, keeping offset <= val.dsize throughout and leaving well-formed records untouched. This mirrors the recent namespace-table hardening in the propdb reader.

[notroj]

Thanks for the PR, but we should be able to treat these DBM files as trusted input, trying to validate them will bring a lot of complexity and not a lot of value. The nspace handling fix is a special case to cope with with the specifics of the apr_xml API.