shopify-scripts: TOCTTOU bug in mrb_str_setbyte leading the memory corruption

The Stringsetbyte function caches the length of the string before loading the function arguments. Loading function arguments through mrbgetargs can call into ruby code to run type conversion methods toi, tos and the like. A malicious conversion method is able to force the string to be reallocated...