Aria recovery: KEY_OP_CHANGE copies log-provided length without checking header_end (OOB read)

In `storage/maria/ma_key_recover.c`, `_ma_apply_redo_index()` handles `KEY_OP_CHANGE` as:
```c
case KEY_OP_CHANGE:
uint length= uint2korr(header);
DBUG_ASSERT(page_offset != 0 && page_offset + length <= page_length);
memcpy(buff + page_offset, header + 2, length);
page_offset+= length;
header+= 2 + length;
```
There is no check that `header + 2 + length <= header_end` before reading from the redo buffer. In release builds the page-side `DBUG_ASSERT` is also a no-op.
A truncated or corrupt `LOGREC_REDO_INDEX` can therefore cause an out-of-bounds read from the log record (and may write past the page if `page_offset + length` is also unchecked).

1. 1. Impact
      Crash recovery / redo apply can crash or read past the redo buffer on a malformed CHANGE record.