Read-past buffer in mariadb_dyncol_get_num()

Found by fuzzing COLUMN_GET() with malformed blobs. In the named format
find_column() only checks that the column directory fits the record, not
the name pool, so init_read_hdr()'s data_size wraps around and read_name()
walks the name pointer past the buffer. mariadb_dyncol_check() and
mariadb_dyncol_unpack() already fold nmpool_size into this check; do the
same on the get path.