fix: guard FFI schema metadata on empty schema

[cyphercodes]

Which issue does this PR close?

• Closes Null pointer dereference in FFI_ArrowSchema::with_metadata when used with empty schema #10286.

Rationale for this change

FFI_ArrowSchema::empty() leaves private_data null. Calling the safe with_metadata builder on that value previously reached Box::from_raw(self.private_data as *mut SchemaPrivateData), which is undefined behavior for a null pointer.

What changes are included in this PR?

• Return a CDataInterface error from FFI_ArrowSchema::with_metadata when private_data is null.
• Add a regression test for calling with_metadata on FFI_ArrowSchema::empty().

Are these changes tested?

Yes:

• cargo fmt -p arrow-schema -- --check
• cargo test -p arrow-schema --features ffi test_set_metadata_on_empty_schema_errors -- --nocapture
• cargo test -p arrow-schema --features ffi test_set_field_metadata -- --nocapture
• cargo test -p arrow-schema --features ffi ffi::tests::test_schema -- --nocapture
• cargo test -p arrow-schema --features ffi
• cargo clippy -p arrow-schema --features ffi --all-targets -- -D warnings

Are there any user-facing changes?

No API shape changes. Calling with_metadata on an empty/released FFI schema now returns an error instead of invoking undefined behavior.

AI assistance

AI assistance was used to prepare this small patch; I reviewed the change and verified it with the commands listed above.

[alamb]

Thanks @cyphercodes

[alamb]

~I don't understand this -- the code below sets private data ~
update -- I see now

        unsafe {
            let mut private_data = Box::from_raw(self.private_data as *mut SchemaPrivateData);
            private_data.metadata = new_metadata;
            self.private_data = Box::into_raw(private_data) as *mut c_void;
        }

[alamb]

FFI_ArrowSchema::empty() leaves private_data null. Calling the safe with_metadata builder on that value previously reached Box::from_raw(self.private_data as *mut SchemaPrivateData), which is undefined behavior for a null pointer.

Perhaps it would be more future proof to just set private_data for the result of FFI_ArrowSchema::empty()?

It seems like it is not unreasonable to set metadata on an empty schema, and I worry that other existing (or newly added) code paths will assume private_data is non null