Aria recovery: KEY_OP_ADD_PREFIX copies changed_length from redo without checking header_end (OOB read)

In `storage/maria/ma_key_recover.c`, `_ma_apply_redo_index()` handles `KEY_OP_ADD_PREFIX` as:
```c
case KEY_OP_ADD_PREFIX:
uint insert_length= uint2korr(header);
uint changed_length= uint2korr(header+2);
DBUG_ASSERT(insert_length <= changed_length &&
page_length + insert_length <= max_page_size);
bmove_upp(buff + page_length + insert_length, buff + page_length,
page_length - keypage_header);
memcpy(buff + keypage_header, header + 4, changed_length);
header+= 4 + changed_length;
page_length+= insert_length;
```
There is no check that `header + 4 + changed_length <= header_end` before the `memcpy` from the redo buffer. In release builds the `DBUG_ASSERT`s are also no-ops.
A truncated or corrupt `LOGREC_REDO_INDEX` can therefore cause an out-of-bounds read from the log record buffer (and may also expand the page unsafely via `insert_length`).

1. 1. Impact
      Crash recovery / redo apply can crash or read past the redo buffer on a malformed ADD_PREFIX record.