fix(dv): validate Puffin blob metadata against manifest

[fallintoplace]

Problem

ReadDV finds a Puffin blob using the manifest entry's content_offset and content_size_in_bytes, then validates its cardinality. It does not verify that the selected footer entry is a deletion-vector-v1 blob for the manifest's referenced_data_file.

That leaves a gap when one Puffin file contains deletion vectors for multiple data files. A malformed manifest entry can point to another blob with the same cardinality, pass the existing checks, and return row positions belonging to a different data file.

Fix

Before reading or decoding the blob payload, ReadDV now:

• requires the manifest entry to have a non-empty referenced_data_file
• verifies that the footer entry selected by offset and length has type deletion-vector-v1
• requires its referenced-data-file property to match the manifest value

The existing cardinality checks and compatibility behavior for a missing Puffin cardinality property are unchanged.

Tests

Added coverage for mismatched and missing data-file references, a non-DV blob at the selected range, and both nil and empty manifest references.

• go test ./table/dv
• go test ./...
• golangci-lint run --timeout=10m