Prohibit Vec::set_len beyond capacity

`Vec::set_len` operation is useful for I/O (reading into uninitialized
memory), however it is too easy to corrupt memory by setting length
larger than capacity.

On the other hand, setting length larger than capacity is almost useless
in practice.

So `set_len` should not allow to set length larger than capacity.