fix int overflow in Allocator.array/arrayList size checks

[alhudz]

Allocator.array and arrayList compute the byte cost with a plain int multiply (request * eltShallowByteSize, 24 + request * 4) before handing it to check, while every typed-array helper goes through the overflow-checked check(int, int). A large count read from an image (e.g. an ICC TagCount in IccProfileParser) overflows int to a small or negative value and slips past the 1 GB limit, allocating well beyond it. Route both through check(request, elementSize) so the same multiplyExact guard applies.