receive: validate remote write v2 symbol references

[r0h1tb]

Changes

translateV2ToV1 resolves remote write v2 label references by indexing the request's
symbols table directly:

Name:  w.Symbols[t.LabelsRefs[i]],
Value: w.Symbols[t.LabelsRefs[i+1]],

Both the references and the table come from the client, so a payload whose
labels_refs point past the end of symbols panics the request goroutine with an
index out of range. Same pattern for exemplar refs. handleV2HTTP unmarshals and
calls the translation with no validation in between, so any v2 client can trigger it.
net/http recovers the panic per connection, so the process survives, but the
request is dropped and a stack trace is logged.

Prometheus enforces two invariants when desymbolizing and returns an error for
either — labels_refs must have even length, and every reference must address the
table (prompb/io/prometheus/write/v2.desymbolizeLabels). The v2 to v1 translation
reimplemented that lookup without them.

• Add desymbolizeLabels with both checks and use it for series and exemplar labels.
• translateV2ToV1 returns an error; handleV2HTTP maps it to 400.

Odd-length labels_refs previously dropped the trailing element silently; it is now
a 400, matching Prometheus.

Verification

Without the fix, a ref past the end panics:

--- FAIL: TestReproSymbolOutOfRange (0.00s)
panic: runtime error: index out of range [99] with length 2 [recovered, repanicked]
	pkg/receive/handler.go:568

translateV2ToV1 had no unit test, which is why this went unnoticed; the new file
covers the happy path and four malformed-reference cases.

go test -tags slicelabels -race ./pkg/receive/ passes and matches the baseline
(ok, 166s). golangci-lint run --build-tags=slicelabels ./pkg/receive/... reports
nothing for the changed or added files; the package's existing goconst findings are
unchanged.

• I added CHANGELOG entry for this change.

[codecov]

Codecov Report

❌ Patch coverage is 84.84848% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.39%. Comparing base (b453e37) to head (a2ec16a).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/receive/handler.go	84.84%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8976      +/-   ##
==========================================
- Coverage   64.54%   63.39%   -1.16%     
==========================================
  Files         289      289              
  Lines       37359    46004    +8645     
==========================================
+ Hits        24115    29166    +5051     
- Misses      11151    14740    +3589     
- Partials     2093     2098       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.