Memory exposure via uninitialized deserialize_string buffer

Memory exposure in messagepack-rs allows attackers to read uninitialized buffer contents via a caller-supplied Read implementation. The deserialize_string function allocates a Vec, unsafely sets its length before initializing its bytes, and passes the buffer to Read::read_exact. Exploitation requires control over the Read implementation used by a consuming application, and the resulting undefined behavior has no single bounded runtime outcome.