Bound the mesh reader against the file size

Every count and size in a .mesh file decided how far the reader would
loop, allocate or read, and none was checked against the file meant to
hold the data. A 16 byte footer could declare four billion meshes; a
four byte field could ask for a four gigabyte allocation; and a subset
name declared longer than the file segfaulted in QString::fromUtf16().

The legacy morph target path derives a whole buffer layout from the file
and was worse: a zero stride divided by zero, one entry claiming target
seven divided by a components per target of zero, an attr_unsupported
name with no target zero to copy from indexed an empty list, a short
attribute name asserted in sliced(), and an attribute offset was added
to a vertex buffer pointer unchecked.

Bound each count by the bytes left on the device, so the limit scales
with the file, and reject what does not fit. The 114 .mesh files here,
covering every supported version, parse byte for byte as before.

Pick-to: 6.12 6.11 6.8
Change-Id: I55c6a00de27c06ad90786bbfc3b90173ff1e0cde
Reviewed-by: Christian Strømme <christian.stromme@qt.io>