Aircraft carrier reads out of bounds when NumSpacesPerRunway does not match its Runway Spaces bones #3659

FlightDeckBehavior builds one parking space per runway for each row up to NumSpacesPerRunway. It never checks that value against the bone names listed in Runway1Spaces and Runway2Spaces.

• If NumSpacesPerRunway is larger than a runway's Spaces list, FlightDeckBehavior::buildInfo steps past the end of that list and reads a bone name from invalid memory.
• If NumSpacesPerRunway is 0 or negative, no parking spaces are built. The takeoff and update code still reads the first space of every runway. A negative value also requests a huge allocation.

Expected: the carrier only builds the spaces its bone lists can supply, and it never reads spaces that were not built.

Retail data is not affected. AmericaAircraftCarrier sets NumSpacesPerRunway = 10 with 10 bones in each runway's Spaces list. The bug shows up with modded INI.

Reproduction Steps

1. In an INI override for AmericaAircraftCarrier, change its FlightDeckBehavior to NumSpacesPerRunway = 11. Leave Runway1Spaces and Runway2Spaces at their 10 bones.
2. Start a map that contains the aircraft carrier.

Second case:

1. Set NumSpacesPerRunway = 0 instead.
2. Start the same map, and let the carrier's jets try to take off or land.

Additional Context

Found by CodeRabbit while reviewing #3356: #3356 (comment)