wgpu_core::Device::buffer_map_async doesn't bounds-check range

[jimblandy]

The wgpu_core::Device::buffer_map_async function doesn't bounds-check range. As far as I can tell, an invalid range will get stashed in wgpu_core::resource::Buffer::map_state, yoinked out in LifetimeTracker::handle_mapping, and make it all the way to the wgpu_hal::Device::map_buffer call in wgpu_core::device::map_buffer, which is much farther than it should get.

Granted, wgpu doesn't need that validation, since it makes map_async a method on BufferSlice, whose length is already validated. But I think the checks are pretty cheap compared to everything else that's going on there, and having them in wgpu_core would benefit all the different language bindings, and Firefox.