Bound the run length writes in the Radiance HDR decoder

decrunchScanline() bounds x against the row width in its outer loop, but
neither run branch rechecks it, so a count byte from the file decides
how far past the end of the scanline buffer to write. A new format run
repeats up to 127 times, a literal copies up to 128 bytes, and an old
format run repeats scanline[x][E] << bitshift times, where bitshift
grows by 8 per consecutive run until the shift itself is undefined.
Crafted files under a kilobyte segfault. Bound every run and literal
against what is left of the row, comparing the old format count against
the row before it is shifted, since the shifted count does not fit in
an int.

The old format branch also overwrote the red channel of the first pixel
with 2. That is a leftover from Radiance's freadcolrs(), which has
already consumed and compared that byte by the time it gets there,
whereas here all four bytes of the pixel are read first, so every row
that is not run length encoded lost its first red sample.

Also: a malformed scanline now ends the decode rather than leaving later
rows holding whatever was on the heap on its way to a GPU texture; the
signature read result is checked, so a short file no longer compares
against uninitialised stack; and the dimensions are capped, since
calculateDataSize() bounds the total and not the width.

Pick-to: 6.12 6.11 6.8
Change-Id: Ia50243743d72c8a6f389f71041215114d9c9f9f3
Reviewed-by: Christian Strømme <christian.stromme@qt.io>