fix(NODE-7611): bounds check findNull scan in on-demand parser

[AbinMadathil-Celigo]

Description

Summary of Changes

A malformed document with a string element declaring a zero length passes the on-demand parser's size/terminator guards and advances the cursor to the declared document end. The next loop iteration then calls findNull from past the end of the buffer: out-of-range Uint8Array reads return undefined (which is never 0x00), so the scan never terminates — a synchronous CPU hang on caller-controlled bytes.

findNull now stops at the end of the input and throws a BSONOffsetError('Null terminator not found') instead of scanning out of range forever. The existing "reached the document terminator" throw is preserved by folding both conditions into nullTerminatorOffset >= bytes.length - 1.

Repro (hangs before this change, throws after):

const BSON = require('bson');
// 10-byte document: string element with empty name declaring stringSize = 0
BSON.onDemand.parseToElements(
  new Uint8Array([0x0a, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00])
);

Notes for Reviewers

• Only the experimental BSON.onDemand.parseToElements path is affected; the standard BSON.deserialize path already rejects stringSize <= 0.
• The ticket also notes the stringSize <= 0 check is not mirrored on the on-demand path. I kept this PR focused on the non-termination bug; mirroring that check would need per-type care (e.g. a zero length is valid for binData) and could be a follow-up.

What is the motivation for this change?

Fixes NODE-7611 (part of NODE-7598).

Release Highlight

BSON.onDemand.parseToElements no longer hangs on malformed input

A malformed document containing a string element with a declared length of zero previously caused a non-terminating scan (synchronous CPU hang). The experimental on-demand parser now throws a BSONOffsetError instead.

Double check the following

• Lint is passing (npm run check:lint)
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[tadjik1]

hi @AbinMadathil-Celigo , thanks for your work! Please check one comment in the code, I believe there is another case we want to make sure works as expected.