Fix UB shm allocation cleanup crashes

[YChange01]

Summary

• Reserve POSIX shm backing with posix_fallocate() after ftruncate() on Linux and validate remote object size before mmap().
• Clear shm pointers after unmap/free and remove double remote-free paths.
• Return EMSGSIZE for payloads that cannot fit in the ring and fix fd truncation in the handshake.

Test Plan

• git diff --check
• cmake --build build --target brpc_ubshm_unittest -j 8
• ./build/test/brpc_ubshm_unittest

Note: local macOS sandbox skips POSIX shm tests because shm_open returns EPERM; Linux should execute them.

Related to apache#3290 reviewer crash reports.