bound MCOS pointer-array walks to the allocated size

[naruto-lgtm]

Repro: read a v5 file whose MCOS subsystem encodes a cell/object whose dimensions imply more elements than the stored matvar_t * array holds (test_mat readvar or matdump -d on such a file).

Cause: ResolveNestedMCOS derives the child count from the product of matvar->dims (times num_fields for the struct/object branch) and walks cells[i]/fields[i] over it, but the dimensions come from subsystem metadata and are not tied to what was actually allocated in matvar->data. When they disagree the loop reads past the pointer array and dereferences the out-of-bounds pointer (ASan heap-buffer-overflow READ at mcos.c:1603 and :1624). ParseSubsystem5 has the same trust issue on the top-level FileWrapper__ array: it dereferences cells[0] right after Mat_MulDims, ahead of the ncells >= 3/5 checks, so a zero- or short-length cell array is indexed out of bounds. The v7.3 path ParseSubsystem73 already validates the cell count before indexing.

Fix: clamp both walks in ResolveNestedMCOS to nbytes / sizeof(matvar_t *), and reject a FileWrapper cell array whose element count exceeds its allocation before using it. For well-formed files the dimensions and the allocation agree, so nothing is clamped and output is unchanged (verified against the committed MCOS dump results).