Harden core RPC marshalling, decode, and message parsing against corrupted data

[linmajia]

Summary

Hardens the core serialization/RPC layer and network message parsers so
malformed or fault-injected data is rejected cleanly instead of asserting,
aborting, or dereferencing null. Bumps the rDSN.dist.service submodule to pick
up the matching meta/replica hardening.

Changes

• Checked (un)marshalling (include/dsn/cpp/serialization.h,
  serialization_helper/thrift_helper.h, clientlet.h, rpc_stream.h,
  serverlet.h, src/dev/cpp/utils.cpp): marshall() throws instead of
  asserting on invalid input/format/writer failure; added try_marshall() /
  try_unmarshall(); typed client/server request/reply paths route through the
  checked wrappers. binary_reader string/blob/buffer reads reject
  negative/over-long lengths.
• Core RPC decode (src/core/src/rpc_engine.cpp, command_manager.cpp,
  dist.uri.resolver/partition_resolver_simple.cpp): on_recv_reply decodes
  the ERR_FORWARD_TO_OTHERS forward address via try_unmarshall and delivers
  ERR_NETWORK_FAILURE on failure instead of forwarding to a garbage address;
  run_command returns false on undecodable CLI response; resolver surfaces
  config-response decode failure via client_err.
• Thrift message parser (src/plugins/tools.common/thrift_message_parser.cpp):
  reject malformed thrift input through the parser error path instead of
  dereferencing a null parse_message() result; catch decode exceptions around
  readMessageBegin; free the temporary message_ex on all failure paths;
  replace the request-only dassert with checked rejection of non-request
  messages.
• Fault injector (src/plugins/tools.common/fault_injector.cpp): safe
  handling of injected header/body corruption.
• Tests (src/core/src/rpc_message.test.cpp): cover try_marshall /
  try_unmarshall null-message, invalid-format, and string round-trip paths.
• Submodule: bump rDSN.dist.service to the hardened revision.