Fix incorrect range check when reading glTF buffer

[bghgary]

This is a follow up to #14540 which still has an incorrect range check. The intention of the readViewAsync checks is to make sure the arguments fit within the given array buffer view.

I've tested against the PG from the forum issue to make sure it still works.

[bjsplat]

Please make sure to label your PR with "bug", "new feature" or "breaking change" label(s).
To prevent this PR from going to the changelog marked it with the "skip changelog" label.

[bjsplat]

Snapshot stored with reference name:
refs/pull/14557/merge

Test environment:
https://babylonsnapshots.z22.web.core.windows.net/refs/pull/14557/merge/index.html

To test a playground add it to the URL, for example:

https://babylonsnapshots.z22.web.core.windows.net/refs/pull/14557/merge/index.html#WGZLGJ#4600

Links to test babylon tools with this snapshot:

https://playground.babylonjs.com/?snapshot=refs/pull/14557/merge
https://sandbox.babylonjs.com/?snapshot=refs/pull/14557/merge
https://gui.babylonjs.com/?snapshot=refs/pull/14557/merge
https://nme.babylonjs.com/?snapshot=refs/pull/14557/merge

To test the snapshot in the playground with a playground ID add it after the snapshot query string:

https://playground.babylonjs.com/?snapshot=refs/pull/14557/merge#BCU1XR#0