Bound CSV recovery offsets across chunks

[osipovartem]

Summary

• make the malformed-record excess-field limit stable for the lifetime of one CSV record
• cap the offsets slice passed to csv-core even when normal batch preallocation is larger
• use checked arithmetic for recovery offset preallocation
• add a regression test that feeds one oversized malformed record across many 17-byte chunks

Why

The initial recovery implementation derived its limit from the current offsets buffer on every decode call. A single record split across many input chunks could therefore grow the limit repeatedly. This follow-up enforces the documented hard bound across chunk boundaries.

Tests

• cargo +1.95.0 test -p arrow-csv --lib --offline (74 passed)
• cargo +1.95.0 clippy -p arrow-csv --all-targets --offline --no-deps -- -D warnings