Fix dangling read buffer in PNG memory decoding

[Tutez64]

Summary

Fix the lifetime of the ReadBuffer passed to libpng when decoding PNG data from memory.

PNG::Decode previously created the buffer inside an if/else block and passed its address to png_set_read_fn. The buffer went out of scope before png_read_info invoked the callback, leaving libpng with a dangling pointer.

The issue was visible when Lime was built with LTO, causing intermittent libpng error: Read Error messages, corrupted or missing images, and occasional crashes.

This change keeps the buffer alive for the entire PNG::Decode call. It also makes ReadBuffer::Read reject reads that exceed the remaining data instead of performing a partial copy.

Repro

LimePNGReadBufferLTORepro.zip