Pass message_factory to reflection->GetMessage in cel::Value::WrapField.

Inside WrapFieldImpl in value.cc, CEL called reflection->GetMessage(*message, field)
without passing message_factory as the 3rd argument. When message is a compiled C++
GeneratedMessage, Protobuf reflection defaulted factory to MessageFactory::generated_factory().

If field is an extension whose descriptor lives in a dynamic DescriptorPool,
generated_factory()->GetPrototype(extension_desc) returns nullptr, causing a
SIGSEGV (@(nil)) in ExtensionSet::GetMessage().

This CL passes message_factory to reflection->GetMessage(*message, field, message_factory)
so Protobuf reflection uses CEL's MessageFactory to resolve dynamic extensions.

PiperOrigin-RevId: 957173111

Author: seirl

common/value.cc

@@ -1583,11 +1583,12 @@ Value WrapFieldImpl(
       }
       if constexpr (Unsafe::value) {
         return Value::WrapMessageUnsafe(
-            &reflection->GetMessage(*message, field), descriptor_pool,
-            message_factory, arena);
+            &reflection->GetMessage(*message, field, message_factory),
+            descriptor_pool, message_factory, arena);
       } else {
-        return Value::WrapMessage(&reflection->GetMessage(*message, field),
-                                  descriptor_pool, message_factory, arena);
+        return Value::WrapMessage(
+            &reflection->GetMessage(*message, field, message_factory),
+            descriptor_pool, message_factory, arena);
       }
     case google::protobuf::FieldDescriptor::TYPE_BYTES: {
       std::string scratch;