fix(metro): vendor image dimension parsing

[robhogan]

Summary

• replace the image-size dependency with an in-tree parser for the image formats Metro supports
• dispatch by the declared asset type rather than running unrelated format detectors
• preserve CgBI PNG, SVG units/viewBox, TIFF endianness, WebP variants, and KTX1/KTX2 support
• reuse the first asset buffer already read for hashing
• reject truncated, mismatched, non-positive, and non-advancing malformed inputs

This removes image-size and its queue dependency without introducing a new third-party package. The parser is derived from the MIT-licensed image-size format support, with its notice retained inline and bounds/forward-progress checks added throughout.

Refs #1762
Refs #1800

Test plan

• yarn flow check
• yarn typecheck-ts
• yarn lint
• yarn build
• node node_modules/jest/bin/jest.js packages/metro/src/lib/__tests__/imageSize-test.js packages/metro/src/__tests__/Assets-test.js --runInBand --no-watchman
• full Jest run: 141 suites passed; the two Watchman integration suites failed because the local environment cannot chmod the shared Watchman state directory
• checked all applicable fixtures from the upstream image-size corpus
• exercised 100,000 randomized malformed buffers across all parsers

Changelog: [Fix] Remove the image-size dependency and parse supported image dimensions within Metro.