Apply image decoder limits before allocation

[ryanfowler]

Summary

• Switched built-in image decoding to image::ImageReader so width, height, and allocation limits are applied before decode() runs.
• Kept the existing post-decode size check as a defense-in-depth guard.
• Added a regression test that feeds a valid PNG header with oversized dimensions and asserts it fails with an image limit error before a full image is allocated.

Testing

• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo test --all-features --test integration -- --test-threads=1