fix(row): guard timestamp conversion against overflow from corrupt data

[hechao-ustc]

Purpose

read_timestamp_value performs unchecked multiplication (* 1_000 / * 1_000_000) on the millis value read from .row files when converting to microsecond or nanosecond precision. A corrupt or malicious file can supply an arbitrary i64 (e.g. i64::MAX), causing a panic in debug builds or silent wrapping in release builds. This PR replaces bare arithmetic with checked_mul + checked_add, returning Error::DataInvalid on overflow.

Brief change log

• Microsecond and Nanosecond arms of read_timestamp_value: replaced bare operators with checked_mul + checked_add + ok_or_else, returning DataInvalid with millis and nanos context on overflow

Tests

• cargo clippy --all-targets --workspace --features fulltext,vortex -- -D warnings
• cargo test -p paimon --all-targets --features fulltext,vortex

API and Format

Documentation

[QuakeWang]

+1