Validate decoded ISO gain-map numeric metadata

[gregbenz]

Validate decoded ISO gain-map numeric metadata

Summary

• reject decoded gain-map values that are non-finite or mathematically unusable
• propagate HEIF/AVIF metadata errors during probe instead of exposing invalid values
• release libheif resources when metadata decoding fails

Why

Malformed ISO gain-map metadata could make uhdr_dec_probe() succeed even when metadata conversion failed. That could expose invalid or uninitialized values to callers and allow non-finite values to reach gain-map calculations. The HEIF/AVIF decode error path also returned before releasing objects it had already created.

This change validates exact rational bounds and converted values before use, then returns the existing metadata error to the caller. It intentionally preserves valid signed offsets and does not add trailing-byte restrictions, keeping versioned payload compatibility policy separate.

Testing

• added conversion tests for zero gamma, overflow, underflow, non-finite HDR capacity, and reversed boost bounds that collapse at float precision
• confirmed valid negative offsets remain accepted
• added runtime-generated malformed AVIF and HEIF regressions for public probe and backend decode
• passed the complete 1,298-test unit suite
• passed focused AVIF/HEIF tests under AddressSanitizer

Addresses the numeric-validation portion of #446; version-aware trailing-byte and payload-size
policy is intentionally left for separate follow-up.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.