Deletion vector bitmap count is read from the blob and used as a loop bound without validation

[sungwy]

DeletionVector._deserialize_bitmap reads an 8-byte count from the start of the payload and uses it directly as a loop bound, appending to a list on each iteration:

number_of_bitmaps = int.from_bytes(pl[0:8], byteorder="little")
...
for _ in range(number_of_bitmaps):
    ...
    bitmaps.append(bm)

Nothing checks the declared count against the actual payload length, so a small blob can declare a large number of bitmaps.

---

Issue investigation generated via claude, reviewed by Sung, Kevin, Fokko.