Out-of-bounds read with an out-of-range `InBuffer::pos`

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTDseekablecompressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and...