[dawn][metal] Fix robustness issues around buffer lengths being u32

On Metal, the sizes of storage buffers (and vertex buffers when
transformed into storage buffers for vertex pulling for robustness) are
passed to MSL in an array of u32 values. Thus, such bindings cannot be
larger than 4GiB-1.

There is no separate limit on vertex buffer binding size (as there is
for storage buffer bindings), so in order to make this safe - without
significantly changing how buffer sizes are passed - this also reduces
maxBufferSize by 4 bytes to 4GiB-4. This should have minimal impact on
apps, but in order to raise it back to 4GiB we can either:
- Pass buffer size minus one (i.e. the max byte index value) into the
  shader so the minus-one step doesn't have to happen inside the shader
- Or just pass sizes as u64.

The tests are verified to fail without the fix, with the exception of
VertexBuffer_ZeroSizeRemaining which exists to help test later when we
raise the limit again.

Test: MetalBufferRobustnessTest.*
Fixed: 488400770
Change-Id: I3b4207b63ba641271b098a964734f70446595814
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/295255
Reviewed-by: Loko Kung <lokokung@google.com>
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>