oem-meta: http-boot: fix heap OOB write on read with offset past EOF

HttpBootHandler::read() for READ_DATA revised the response length with

```
    if (offset + data->length >= sb.st_size)
        data->length = sb.st_size - offset;
```

Both offset (uint16_t) and length (uint8_t) are host-supplied. When the
host passes an offset beyond the end of the bios-rootcert file, lseek()
past EOF succeeds and sb.st_size - offset is negative; the implicit
conversion to uint8_t wraps (e.g. 2000 - 2001 -> 255). The memcpy()
into the respbuf data[] region sized from the original request length
then writes out of bounds, corrupting the heap, and the over-written
bytes are encoded back into the response.

Reject offsets at or beyond EOF so the subtraction cannot underflow,
and clamp the revised length to min(requested, remaining) so it can
never exceed the caller's response buffer. Also fail short reads
instead of returning uninitialized bytes, and clamp any over-long
handler length in FileIOHandler::readFileIO as defense in depth.

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Reported-by: Yu Chen <paloaltoalex@gmail.com>
Assisted-by: opencode:meta/muse-spark-1.3
Change-Id: Ic9c26aeeb933aeed2ec1f267be661329cc9507e2