Fix heap-buffer-overflow in BitReader and Huffman table

[sharadboni]

Summary

• BitReader OOB read: In BitReaderState::GetNextByte(), when the last byte of entropy-coded data is 0xFF, pos_ is incremented to len_, and then data_[pos_] reads one byte past the buffer. Added a bounds check before reading the escape byte.
• Huffman table overflow: BuildJpegHuffmanTable() writes entries to a pre-allocated LUT buffer of kJpegHuffmanLutSize (758) entries, but never validates that total_size stays within bounds. Under-subscribed Huffman codes in a crafted JPEG can cause total_size to exceed the buffer, leading to heap-buffer-overflow. Added an overflow check in BuildJpegHuffmanTable() and validated the return value in the caller (ProcessDHT).

Both vulnerabilities can be triggered by crafted JPEG files and lead to heap-buffer-overflow reads/writes.

Test plan

• Verified both changed files compile cleanly with g++ -std=c++11
• Fuzz with AFL/libFuzzer using the existing fuzz_target.cc
• Test with corpus of valid JPEG files to verify no regressions

[sharadboni]

@jan-wassenberg @jyrkialakuijala Could you review this security fix? It addresses a heap-buffer-overflow read in the JPEG bit reader (GetNextByte) and a Huffman table overflow from under-subscribed codes in BuildJpegHuffmanTable.