Bounds checking in MutableBuffer::set_null_bits can be bypassed

[kawadakk]

Describe the bug
Bounds checking in MutableBuffer::set_null_bits can be bypassed by supplying input parameters that would cause integer overflow, breaking the safety guarantees.

To Reproduce

fn main() {
    let mut buf = arrow::buffer::MutableBuffer::new(0);
    buf.set_null_bits(1, usize::MAX);
}

$ cargo run --release --quiet
fish: Job 2, 'cargo run --release --quiet' terminated by signal SIGSEGV (Address boundary error)

Expected behavior
Avoiding undefined behaviour by panicking, aborting, or silently saturating a given range.

Additional context

[tustvold]

label_issue.py automatically added labels {'arrow'} from #4621