remap: bound the plugin argument arrays

[brbzull0]

BUILD_TABLE_INFO sizes its argument arrays at BUILD_TABLE_MAX_ARGS, which is
2048 (include/proxy/http/remap/RemapConfig.h:31,62-63):

char *paramv[BUILD_TABLE_MAX_ARGS];
char *argv[BUILD_TABLE_MAX_ARGS];

remap_load_plugin() declared its own locals at half that:

const char *new_argv[1024];
char       *pargv[1024];

so a remap.config line carrying more than 1024 arguments overflowed them. In a
build with ink_assert enabled the existing assertion at
RemapConfig.cc:912 catches it and aborts; without it the writes simply run off
the end of two stack arrays.

Two further bounds issues in the same path:

• The jump_to_argc copy loop was while (argv[i + jump_to_argc]), i.e. it
  walked until it found a null entry rather than stopping at argc.
• remap_parse_config_bti() appended to bti->argv / bti->paramv inside the
  tokenizer loop but only compared against BUILD_TABLE_MAX_ARGS after the loop
  had finished, so bti->argc could pass 2048 before anything checked.

Change

• Size new_argv and pargv from BUILD_TABLE_MAX_ARGS + 1, so they can hold
  the full limit plus the nullptr sentinel the copy loop reserves.
• Bound the copy loop by argc and by countof(new_argv) - 1.
• Reject an over-long line while tokenizing, with the file and line number in
  the error, instead of after the fact.

Test

Adds tests/gold_tests/remap/remap_plugin_argument_limits.test.py, with a
near-limit rule that must load and serve, and an over-limit rule that must be
rejected. There is no existing test in tests/gold_tests/remap/ covering the
argument count, and no collision with the 32 entries already there.

Confirmed it is a regression test: against unpatched RemapConfig.cc it fails
with

Fatal: RemapConfig.cc:912: failed assertion
`static_cast<unsigned>(argc) < countof(new_argv)` : 3

so traffic_server aborts while parsing remap.config. With the change the
test passes.

[brbzull0]

[approve ci ubuntu]

[brbzull0]

[approve ci autest 2]

[brbzull0]

[approve ci freebsd clang-analyzer autest 2]