Exp-Golomb values read with `read_ue()` can be as large as u32::MAX, so
`read_ue()? + N`, `log2_min + read_ue()?` and the cropping / conformance
window arithmetic overflowed: a panic in debug builds, and in release a
silent wrap (e.g. pic_width_in_mbs_minus1 = u32::MAX became a width of 0,
which passed the `<= 1024` check).
- bitstream: add `BitReader::read_ue_plus(n)`, an overflow-checked
`ue(v) + n` that returns InvalidExpGolomb.
- h264/hevc: use it for every `read_ue()? + N`; saturate the log2 size
sums (the existing range checks then reject them); validate the H.264
crop in u64; make HEVC `crop_rect` saturating; validate the HEVC RPS
delta range before casting to i32.
- Regression tests for each (they fail on the previous code).
5fed177cbe