fix(jpegxl): harden against corrupt input

[lgritz]

• Overflow protection for the out-buffer-size sanity check, which computed xsizeysizechannels*bits/8 as uint32 previously.
• The result of m_io->read() was captured but never checked; a short read left the tail of the input buffer uninitialized and handed it to libjxl. Error out when the read is short.
• If the decode loop reached JXL_DEC_SUCCESS with basic info but never requested an image-out buffer, m_buffer stayed null while open() returned success, so a later read_native_scanline() dereferenced null. Reject such files at open time.
• Add a truncated-codestream test for jxl.

Assisted-by: Claude Code / Claude Opus 4.8