gh-143546: Fix heap buffer overflow in set_clear_internal

[aviralgarg05]

This PR fixes a heap buffer overflow vulnerability in set_clear_internal (Issue gh-143546).

The Issue

The function set_clear_internal could read past the end of the allocated table buffer if the set's used count became inconsistent with the actual table state. This inconsistency occurs due to re-entrancy: if eq is invoked on a set element during an intersection operation (e.g., set_iand), user code can mutate the set (clearing or resizing it) while the interpreter is still holding pointers to the old table.

The Fix

I added a bounds check to the clearing loop in set_clear_internal. The loop condition now strictly enforces entry < table + oldsize in addition to checking used > 0. This guarantees that the loop terminates safely before accessing invalid memory, even if so->used is corrupted or inconsistent with the current table size.

Testing

Added a new regression test test_reentrant_clear_in_iand in Lib/test/test_set.py. This test reproduces the crash scenario by defining a custom object with a re-entrant eq method that clears the set during a set_iand (&=) operation.

[bedevere-app]

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.