Aria recovery: KEY_OP_SHIFT adds signed redo length to unsigned page_length with only debug asserts

In `storage/maria/ma_key_recover.c`, `_ma_apply_redo_index()` ends every `KEY_OP_SHIFT` with:
```c
case KEY_OP_SHIFT:
int length= sint2korr(header);
header+= 2;
DBUG_ASSERT(page_offset != 0 && page_offset <= page_length &&
page_length + length <= max_page_size);
...
page_length+= length; /* length is signed; page_length is unsigned */
```
In release builds (`DBUG_OFF`), the assert is a no-op. A crafted positive `length` can push `page_length` past `max_page_size`; a large negative `length` can wrap `page_length` through underflow. Later stores / cleans use that corrupted length (including `_ma_store_page_used` and the trailing `bzero` path).
This is the page-length side of `KEY_OP_SHIFT` (related to, but distinct from, the negative-length `bmove` OOB issue).

1. 1. Impact
      Corrupt Aria `REDO_INDEX` during recovery can wrap/inflate `page_length` and lead to further buffer misuse or crash.