refactor: prevent out-of-bounds read (#39936)

`IsReadmeFileExtension("readme", exts...)` panicked with `index out of
range [6] with length 6` when `exts` had no empty extension. The only
caller always passes one, so this was not reachable in practice.

Fixes:
https://github.com/go-gitea/gitea/security/quality/rules/go%2Findex-out-of-bounds

Written by Claude.

modules/util/path.go

@@ -360,7 +360,7 @@ func IsReadmeFileExtension(name string, ext ...string) (int, bool) {
 		}
 	}
 
-	if name[6] == '.' {
+	if len(name) > 6 && name[6] == '.' {
 		return len(ext), true
 	}
 

modules/util/path_test.go

@@ -142,6 +142,10 @@ func TestMisc_IsReadmeFileName(t *testing.T) {
 		assert.Equal(t, testCase.expected, ok)
 		assert.Equal(t, testCase.idx, idx)
 	}
+
+	idx, ok := IsReadmeFileExtension("readme", ".md")
+	assert.False(t, ok)
+	assert.Zero(t, idx)
 }
 
 func TestCleanPath(t *testing.T) {