OOB read in parser constructor on malformed Rows_log_event

When parsing a Rows_log_event (v1 or v2; Write, Update, or Delete), the buffer size is not checked before reading the “number of columns” field, similar to Format_description_log_event::common_header_len before MDEV-40365.

This means a (somehow) malformed Rows_log_event can trigger a memory error from an out-of-bounds read – although odds are slim since it’s only at most 9 bytes.
It won’t lead to memory disclosure in the absence of a memory-error crash, either, because unless it’s 0, the fields following this number are checked against the passed buffer range.