4.41.1: ESM deep-import fix and HEIC/AVIF DoS security fix

Fixed

• The src directory is now correctly declared as ES modules through a nested
  package.json type marker that ships with the npm package. Node-native ESM
  deep imports such as import 'exifreader/src/exif-reader.js' work now instead
  of crashing, and require() of the same files works on Node 22.12 and later.
  The default entry points are unchanged.

Security

• Fixed a denial-of-service vulnerability (GHSA-pj96-35fp-cfcc) where a crafted
  HEIC or AVIF file could trigger excessive memory allocation and crash the
  process during metadata parsing. See the advisory for details.
  Reported by @alienkeric.

Full Changelog: v4.41.0...v4.41.1