Bogus attribute-number range checks in spi.c

The various exported functions in spi.c that take an attribute number
are not consistent about how they range-check it --- some test against
tupdesc->natts and some against HeapTupleHeaderGetNatts(tuple).
(Look for references to SPI_ERROR_NOATTRIBUTE to see what I'm talking
about.)

I'm thinking that the former is correct and the latter is simply wrong.
There are two possible cases:

* tupdesc has more columns than the tuple does.  This is possible after
ALTER TABLE ADD COLUMN, for example.  The correct interpretation in
this situation is that the extra columns exist but are NULL.  Throwing
an error is not correct.  The code perhaps thinks it's protecting
heap_getattr against an out-of-range attnum, but heap_getattr is
supposed to take care of itself that way.

* tupdesc has fewer columns than the tuple does.  I think this can
happen in certain inheritance cases --- we might be inspecting a child
tuple using a parent's tupdesc.  Whether it's possible or not, it's
simply wrong for the code to use the larger number, as that would result
in accessing off the end of the tupdesc's attribute array.

So I think this needs to be made consistent, and furthermore that it's
a backpatchable bug fix.  Comments?
        regards, tom lane