fix: correctly check bounds on read_at

[blinsay]

We're incorrectly checking bounds on read_at calls. The kernel happens to be calling us correctly through FUSE but nothing was actually stopping us from reading beyond the bounds of a file.

The bug is a one-line fix: actually take into account the read offset when calculating read length:

-                let read_len = std::cmp::min(range.len, buf.len() as u64);
+                let read_len = std::cmp::min(range.len.saturating_sub(offset), buf.len() as u64);

The problem was masked by object store implementations happily returning partial ranges and the kernel doing bookeeping correctly. All of our fuzz tests at the moment are mediated through the kernel's FUSE driver, so they didn't turn this up.

I added a simple test for this that would have caught the original bug with an out-of-bounds. It might be worth adding a direct volume fuzz just for this.