yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

> [!NOTE] > This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification. ## The Issue The crate exports a public safe API [`Rules::deserialize`](https://github.com/VirusTotal/yara-x/blob/5bd1f35db783679c90a3ea1a66bd15fe4e55bef1/lib/src/compiler/rules.rs#L187-L254) accepting any generic byte sequence `B: AsRef<[u8]>`. It restores compiled rule structures directly from raw bytes using `bincode::serde::decode_from_slice`. This decoded `Rules` struct contains internal lookup tables, including `sub_patterns: Vec<(PatternId, SubPattern)>`, `atoms: Vec`, and `lit_pool: BStringPool`. Subsequent safe operations assume these internal tables satisfy strict structural invariants: - `Rules::get_sub_pattern` executes `unsafe { self.sub_patterns.get_unchecked(sub_pattern_id.0 as usize) }`. If untrusted serialized bytes contain an atom referencing an out-of-bounds `SubPatternId`, calling `get_sub_pattern` during scanning triggers an out-of-bounds memory read (Undefined Behavior). https://github.com/VirusTotal/yara-x/blob/5bd1f35db783679c90a3ea1a66bd15fe4e55bef1/lib/src/compiler/rules.rs#L355-L360 - `Metadata::next()` extracts string metadata via `unsafe { s.to_str_unchecked() }`. If serialized bytes corrupt `lit_pool` indices or structural data, `to_str_unchecked` constructs a `&str` pointing to invalid UTF-8 bytes (Undefined Behavior). https://github.com/VirusTotal/yara-x/blob/5bd1f35db783679c90a3ea1a66bd15fe4e55bef