Prohibit Vec::set_len beyond capacity

`Vec::set_len` operation is useful for I/O (reading into uninitialized
memory), however it is too easy to corrupt memory by setting length
larger than capacity.

On the other hand, setting length larger than capacity is almost useless
in practice.

Thus prohibiting `set_len` beyond capacity seems to be the best option.