[py] reject negative enum and union index in binary decoder

[arib06]

What is the purpose of the change

read_enum, read_union and skip_union in the Python binary decoder read the enum symbol index / union branch index from the wire and validate it with an upper-bound-only check (index >= len(...)). A negative index is not caught. Because the index is then used directly to subscript writers_schema.symbols / writers_schema.schemas, and Python lists accept negative subscripts, a crafted negative zigzag index passes validation and wraps to an element counted from the end of the list. For an enum this silently returns the wrong symbol; for a union it selects a branch that the writer never declared and decodes the following bytes with that wrong branch schema, which is a decode-time type confusion and desyncs the stream for skip_union. Positive out-of-range indices are already rejected, so this only closes the negative side. The check becomes 0 <= index < len(...) at all three sites.

Verifying this change

This change added tests and can be verified as follows:

• Added test_negative_enum_index and test_negative_union_index in TestMisc, feeding a single 0x01 byte (zigzag -1) as the index. Both assert SchemaResolutionException. Against the unpatched decoder the enum read returns symbols[-1] and the union read decodes via schemas[-1], so both tests fail before the fix.
• Full test_io suite green (152 tests).

Documentation

• Does this pull request introduce a new feature? no