[Flight Reply] Check that a typed array's backing entry is a Blob #37822

Summary

Refs #37560.

parseTypedArray in ReactFlightReplyServer looks up the backing entry for a typed array or ArrayBuffer reference ($A, $O, $o, $U, $S, …) and calls .arrayBuffer() on it without checking its type. If a reply body points that reference at a plain string field, or at an entry that doesn't exist, decoding fails with an opaque TypeError:

• string entry: backingEntry.arrayBuffer is not a function
  


• missing entry: Cannot read properties of null (reading 'arrayBuffer')
  

The $B (Blob) case already guards this with instanceof Blob (#36055). This PR adds the same guard to parseTypedArray, so both paths reject with Referenced Blob is not a Blob. The message reuses the existing error code, so no new code is needed.

The issue's open question (whether a reference may come before its values) is left alone. A typed array reference always needs its bytes, so a missing or non-Blob entry is invalid either way.

How did you test this change?

I added two tests to ReactFlightDOMReply-test.js, mirroring the existing $B test: one where a $U reference points at a string field and one where its entry is missing. Both fail on main with the TypeErrors above and pass with this change.

• 
  yarn test ReactFlightDOMReply: 45 passed


• 
  yarn test -r=www-modern ReactFlightDOMReply: 45 passed


• 
  yarn test -r=stable ReactFlightDOMReply: 45 passed


• 
  yarn test --prod ReactFlightDOMReply: 45 passed


• 
  flow check (dom-node): no errors


• 
  yarn prettier, yarn linc: clean