Use correct data length in Array#flat

[dcodeIO]

Fixes #2018 where it was discovered that Array#flat erroneously used the backing buffer's byteLength instead of its length, leading to an OOB memory.copy into subsequent data.

In the concrete repro, the array header was overwritten with zeroes, leading to the reported effect when the backing buffer is larger than the length, say after a resize triggered by push.

• I've read the contributing guidelines
• I've added my name and email to the NOTICE file