[PATCH] pg_surgery: check the page header and line pointers

Hi hackers.

heap_force_kill() and heap_force_freeze() index a stack array,
include_this_tid[MaxHeapTuplesPerPage], using PageGetMaxOffsetNumber().

That comes from pd_lower, so a page with pd_lower, pd_upper and
pd_special all 8192 passes PageIsVerified() but has max offset
(8192 - 24) / 4. The array is then read past its end and the backend
crashes.

ERROR: AddressSanitizer: stack-buffer-overflow READ at heap_surgery.c:256
[32, 323) 'include_this_tid' <== overflows

Superuser and owner only, so not a security issue.

Thanks,
Shihao