Array sizes and offsets overflow int #94

Several Array paths compute sizes or offsets in int without an overflow check, so large values wrap and memory outside the buffer is written:

• ArrayBase's constructor and __SetSizeExact (src/Array.cpp) multiply the element count by the element size in int. new haxe.ds.Vector<Float>(536870928) gets a 128-byte buffer with that length, and writes overwrite other objects. Only reserve/Realloc have the "Array allocation too large" guard.
• ArrayBase::Blit checks the source range but not the destination: Bytes.alloc(16).blit(2147483647, src, 0, 1) writes 2 GB past the buffer, and a 4-byte NativeArray.blit near INT_MAX writes over the buffer's GC header.
• Array_obj::Item calls EnsureSize(inIndex+1), which overflows for a[2147483647] = x and then writes out of bounds.
• joinArray sums element lengths in int, so joining many copies of one large string allocates a small buffer and copies gigabytes into it.

Other targets throw or run out of memory instead.