libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

An attacker crafts a HEIF/AVIF file containing `cmpC`/`icef` properties with a `unit_offset` and `unit_size` pair whose unsigned addition wraps past the end of the compressed item buffer. Because the decoder validates using `unit_offset + unit_size` (which wraps), the range check passes, and `get_compressed_image_data_uncompressed` in `unc_decoder.cc` [ref_id=1] constructs a vector from iterators outside the buffer, causing an out-of-bounds heap read and crash.

The vulnerable function is `unc_decoder::get_compressed_image_data_uncompressed` in `libheif/codecs/uncompressed/unc_decoder.cc` [ref_id=1]. The range check `unit_offset + unit_size` is performed on unsigned values, allowing integer wraparound to bypass the validation.

The advisory [ref_id=1] recommends replacing the wrapping addition check with a subtraction form: reject `unit_offset > compressed_bytes.size()`, then reject `unit_size > compressed_bytes.size() - unit_offset`. This prevents overflow because the subtraction cannot wrap when `unit_offset` is already within bounds. The fix also requires rejecting offsets that cannot be represented as valid iterator distances before constructing vectors or spans.