Out-of-bounds read when decoding internal keys shorter than 16 bytes

InternalKeyRef::fromencoded is a safe constructor whose only length check is debugassert!encoded.len = 16, which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: userkey slices &encoded..len - 16, trailer/seqnum pass len - 16 and timestamp passes...