crush/mapper: ensure bucket id is valid before indexing buckets array

crush/mapper: ensure bucket id is valid before indexing buckets array

We were indexing the buckets array without verifying the index was within
the [0,max_buckets) range.  This could happen because a multistep rule
does not have enough buckets and has CRUSH_ITEM_NONE
for an intermediate result, which would feed in CRUSH_ITEM_NONE and
make us crash.

Fixes: #13477
Signed-off-by: Sage Weil <sage@redhat.com>
(cherry picked from commit 976a24a326da8931e689ee22fce35feab5b67b76)
(cherry picked from commit 81d8aa14f3f2b7bf4bdd0b4e53e3a653a600ef38)