Harden codec and metadata input validation

[JimBobSquarePants]

This updates codec input validation, metadata handling, floating-point pixel conversion and CCITT encoding on release/4.1.x. The fixes use supplied malformed inputs and targeted regression cases, while retaining the distinction between recoverable data errors and structural errors that prevent decoding from continuing safely.

Changes

• Validate decoded BMP, GIF and TGA dimensions before creating image buffers.
• Reject duplicate PNG headers in both decoding and identification. Calculate scanline lengths with wide arithmetic before narrowing to supported buffer sizes, and apply the ancillary integrity policy to invalid compressed ICC and text metadata.
• Share stream-range validation through extensions on BufferedReadStream. Check BMP ICC offsets and lengths and WebP metadata lengths before allocation, account for WebP padding without overflow, and use the same range checks for JPEG segments. Preserve metadata-skip and recovery behavior, including the mandatory framing checks for WebP ICC chunks before image data.
• Apply ExifProfile.Parts at the serialization boundary, including lazy profiles and profiles installed immediately before serialization. This is a shared EXIF fix, not a WebP-only filter.
• Validate ICC tag extents and minimum sizes, calculate CLUT storage from the product of its grid dimensions, and verify that the payload fits before allocating. Reject channel counts unsupported by the four-component conversion machinery without rejecting otherwise valid profiles merely being preserved.
• Make Numerics.Clamp consistent across scalar, vector and floating-point span overloads: NaN maps to the lower bound and infinities clamp to the endpoints. Use that contract in scaled half-pixel conversions, with matching individual-pixel and bulk behavior. Native IEEE packing remains unchanged; no clamp is added to histogram equalization or luminance indexing, and TensorPrimitives_ is unchanged.
• Bound BigTIFF directory entry counts by the bytes available. Size CCITT Group 3, Modified Huffman and Group 4 encoder buffers using their encoded-bit bounds, with pixel round-trip coverage for narrow images.
• Validate EXR decompressed block lengths, including partial final blocks, and interpret signed scanline coordinates relative to the data window. Initialize omitted color channels and clear failed blocks when IgnoreImageData permits recovery. Handle incomplete zlib initialization without dereferencing a null stream.

Regression coverage and validation

Coverage includes supplied PNG, ICC and TIFF payloads, metadata integrity and skip options, floating-point scalar/bulk conversion parity, CCITT pixel round trips, and EXR block recovery. EXR tests distinguish missing or truncated zlib headers from a complete zlib stream that inflates to zero bytes, using deterministic empty-stream bytes across runtimes.

At b11f2eb64, all eight build/test matrix jobs passed in CI run 33940269331: .NET 8 and .NET 10 on Windows, macOS, Ubuntu x64 and Ubuntu ARM64 runners.

Local Release builds also passed, followed by 93 EXR tests on each of .NET 8 and .NET 10 through VSTest, with no failures or skips.