fix: reject malformed metadata file versions

[fallintoplace]

Summary

• reject malformed and out-of-range version segments in metadata filenames instead of accepting a valid numeric prefix
• start generated metadata filenames at version 0 when the current version cannot be parsed, matching Java
• add coverage for trailing characters, overflow, and an empty version segment through the metadata write path

Testing

• arrow_test --gtest_filter=MetadataIOTest.WriteMetadataWithBase
• full CTest suite (17 test binaries)

[evindj]

This is a non blocking comment (especially given that this is a private method) but I wonder if we should change ParseVersionFromLocation() to return Result<> to ensure that callers explicit have to check for errors and act accordingly.

[fallintoplace]

I considered that, but a parse failure is intentionally handled by starting at version 0, which matches the Java behavior. Returning the error from Write would change that fallback. Since this is a private helper with one caller and the -1 behavior is documented, I think keeping the sentinel is simpler here.