fix(iff): Handle non-zero origin, protect against buffer overflows

[lgritz]

IffInput::read_native_tile was simply incorrect for images with nonzero data window origin. Fix!

Also switch the forumulation to use spancpy rather than memcpy, to be a little more careful that we are't overwriting the presumed sizes of the buffers.

And while I'm in there, I realized we can hold the mutex for less time.

[lgritz]

Any comments about this potentially serious bug? This was found externally via fuzzing by people looking for security issues, so I'd like to get it integrated as soon as possible.

[Copilot]

Pull Request Overview

This PR fixes a critical bug in IFF image reading when handling images with non-zero data window origins and improves buffer safety through the use of span-based copying instead of raw memcpy.

• Corrects tile coordinate calculations to account for non-zero image origin offsets
• Replaces unsafe memcpy operations with spancpy for buffer overflow protection
• Optimizes mutex lock scope to reduce contention

Comments suppressed due to low confidence (1)

src/iff.imageio/iffinput.cpp:529

• After adjusting x to be relative to the data origin (line 521), this calculation may be incorrect. If x is negative after adjustment, tw could be larger than intended or negative. Similarly, the comparison should likely be against the image width considering the origin. Add validation that x >= 0 and ensure width calculations account for the adjusted coordinate space.

    int tw = std::min(x + static_cast<int>(m_header.tile_width),
                      static_cast<int>(m_header.width))
             - x;

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[lgritz]

This fixes an important issue and has gone for a week without objection. Merging.