queue_event: fake ROTATE checksum adjust copies into fixed rot_buf without bounding event_len (stack OOB)

In `sql/slave.cc`, `queue_event()` uses a fixed stack buffer for fake ROTATE checksum special-cases:
```c
uchar rot_buf[LOG_EVENT_HEADER_LEN + ROTATE_HEADER_LEN + FN_REFLEN]; /* 539 bytes */
```
On the RSC_1 path (fake Rotate, master checksum OFF, relay-log checksum ON):
```c
if (uint4korr(&buf[0]) == 0 && checksum_alg == BINLOG_CHECKSUM_ALG_OFF &&
mi->rli.relay_log.relay_log_checksum_alg != BINLOG_CHECKSUM_ALG_OFF)

{ event_len += BINLOG_CHECKSUM_LEN; memcpy(rot_buf, buf, event_len - BINLOG_CHECKSUM_LEN); ... int4store(&rot_buf[event_len - BINLOG_CHECKSUM_LEN], rot_crc); }

```
There is no check that `event_len` fits in `rot_buf`.
`Rotate_log_event` ctor caps `ident_len` to `FN_REFLEN-1`, but RSC still uses the original `event_len`. A max-sized rotate already makes the final `int4store` write past the 539-byte buffer; a larger fake ROTATE overflows further via `memcpy`.
RSC_2 (strip checksum) has the same missing bound on `memcpy(rot_buf, buf, event_len)`.

1. 1. Impact
      Slave IO thread can stack-overflow / crash when queuing a crafted fake ROTATE under checksum policy mismatch.