fix(reader): validate segment specs in the HTTP reader

VortexHttpReader.open called PostscriptParser.parseBlobs directly, skipping
the validateSegmentSpecs containment check that the local-file path runs
inside PostscriptParser.parse. A malformed remote footer could therefore
carry segmentSpecs whose offset/length fall outside the file, which
rawSegment() would turn into out-of-bounds Range requests. Validate against
fileSize before constructing the reader.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

reader/src/main/java/io/github/dfa1/vortex/reader/VortexHttpReader.java

@@ -124,6 +124,10 @@ public static VortexHttpReader open(URI uri, ReadRegistry registry, HttpClient c
                                   : null;
 
         var parsed = PostscriptParser.parseBlobs(footerBuf, layoutBuf, dtypeBuf);
+        // Reject footer segmentSpecs that fall outside the file before any rawSegment() builds a
+        // Range request from them. The local-file path runs this inside PostscriptParser.parse;
+        // the HTTP path calls parseBlobs directly and must validate here too.
+        PostscriptParser.validateSegmentSpecs(parsed.footer().segmentSpecs(), fileSize);
 
         return new VortexHttpReader(
             uri, client, fileSize, trailer.version(),