Bound parser counts before allocation

[Michae2xl]

Summary

• reject CompactSize counts or lengths that cannot fit in the remaining parser input before allocating slices
• cover block transaction counts, block header Equihash solution length, transparent inputs and outputs, Sapling v4/v5 spends and outputs, JoinSplits, and Orchard actions
• preserve valid parsing behavior while returning earlier errors for malformed or truncated input

Testing

• GOCACHE=/tmp/zcash-lightwalletd-go-build go test ./parser