mruby-io: validate negative length in io#gets; fix #6646

io_gets was passing negative limit values to io_buf_cat without
validation, causing negative-size-param in memcpy detected by ASAN.

Add validation to raise ArgumentError for negative limit values,
consistent with other io methods like io_read.

Co-authored-by: Claude <noreply@anthropic.com>

mrbgems/mruby-io/src/io.c

@@ -1971,6 +1971,9 @@ io_gets(mrb_state *mrb, mrb_value io)
 
   mrb_value outbuf;
   if (limit_given) {
+    if (limit < 0) {
+      mrb_raisef(mrb, E_ARGUMENT_ERROR, "negative length %i given", limit);
+    }
     if (limit == 0) return mrb_str_new(mrb, NULL, 0);
     outbuf = mrb_str_new_capa(mrb, limit);
   }