AVRO-4298: [php] Reject negative block size on negative array/map blocks

Addresses review feedback: when decoding a negative array or map block count,
the subsequent block-size long was read and ignored without validation. Avro
binary encoding specifies block size as a byte count, so a negative value is
malformed. Reject it early to match skipArray/skipMap and prevent malformed
input from proceeding further than necessary.

Assisted-by: GitHub Copilot:claude-opus-4.8

Author: iemejia

lang/php/lib/Datum/AvroIODatumReader.php

@@ -317,7 +317,10 @@ public function readArray(
                     throw new AvroException('Invalid array block count');
                 }
                 $blockCount = -$blockCount;
-                $decoder->readLong(); // Read (and ignore) block size
+                $blockSize = $decoder->readLong(); // block byte-size
+                if ($blockSize < 0) {
+                    throw new AvroException('Invalid negative array block size');
+                }
             }
             self::ensureCollectionAvailable($decoder, count($items), $blockCount, $minBytes);
             for ($i = 0; $i < $blockCount; $i++) {
@@ -353,8 +356,10 @@ public function readMap(
                     throw new AvroException('Invalid map block count');
                 }
                 $pair_count = -$pair_count;
-                // Note: we're not doing anything with block_size other than skipping it
-                $decoder->readLong();
+                $blockSize = $decoder->readLong(); // block byte-size
+                if ($blockSize < 0) {
+                    throw new AvroException('Invalid negative map block size');
+                }
             }
 
             // Map keys are strings (>= 1 byte length prefix) plus the value.