[Util] Fix 32-bit wrap of util.string.format placeholder-count check (#24685)

## Summary
Compute `util.string.format`'s expected-operand count in 64-bit so a
near-`UINT_MAX` placeholder index cannot wrap the check and slip past
verification into an out-of-bounds access.

## Context
`util.string.format` interpolates its operands into `{N}`-style
placeholders. Its verifier — and `StringFormatOp::fold` — determine how
many operands the op should have from the highest placeholder index in
the format string, computed as `maxArgIndex + 1`. `maxArgIndex` was a
32-bit `unsigned`.

## Problem
A format string with an explicit placeholder index of `UINT_MAX` makes
`maxArgIndex + 1` overflow to `0`, so the verifier expects `0` operands
and accepts the op even though the placeholder references argument
`4294967295`. `fold` (and the verifier's own indexing) then read
`argStrings[4294967295]` on an empty list — an out-of-bounds read. For
example, before this change the following op passed verification:
```mlir
%0 = util.string.format "{4294967295}"() : () -> !util.buffer
```

## Fix
Cast `maxArgIndex` to `uint64_t` so `maxArgIndex + 1` no longer wraps; an
out-of-range placeholder is now rejected at verification. The same
computation exists in two copies of `parseFormatString` (the verifier in
`UtilOps.cpp` and the folder in `UtilOpFolders.cpp`); both are updated.

`string_format_index_overflow` in `op_verification.mlir` checks the op
above is now rejected with a diagnostic instead of passing verification.

---
Disclosure: this contribution was authored with an AI coding assistant
(Claude) and reviewed before submission.

Signed-off-by: Eylon Krause <eylon1909@gmail.com>