fix: validate union child bounds without truncating lengths

[sunchao]

Why are the changes needed?

Which issue does this PR close?

Closes #10845.

Rationale for this change

A dense Union can have a child longer than i32::MAX while referencing only valid i32 offsets. UnionArray::try_new truncates child lengths to i32, so the length can collide with its missing-type sentinel or fail the bounds check. A NullArray reproduces this without a large allocation.

What changes were proposed in this PR?

What changes are included in this PR?

Keep child lengths as Option<usize>, separating a missing type ID from a valid length. Reject negative offsets before converting them to usize for comparison. Add coverage for lengths i32::MAX + 1 and i32::MAX + 2, offsets zero and i32::MAX, and invalid negative offsets.

Are there any user-facing changes?

Previously rejected valid Unions are accepted. Invalid type IDs and out-of-bounds offsets still return errors. No public API changes.

How was this PR tested?

Are these changes tested?

• The large-child test failed on the unchanged base with the type-ID error, then passed with the fix; both constructed arrays pass full Arrow validation.
• cargo test --offline -p arrow-array --lib: 719 passed, 1 ignored.
• cargo clippy --offline -p arrow-array --all-targets --all-features -- -D warnings: passed.
• cargo fmt --all -- --check: passed.
• Independent source review checked missing IDs, empty children, signed offsets, and the safety of the lookup after type-ID validation.

AI assistance: Codex generated the implementation, regression tests, and PR text, and performed the stated local checks and source review. This does not claim a separate human review.