Fix Android frame buffer crash

[jfversluis]

Summary

Fixes #291.

The crash log shows a native SIGSEGV on CameraX's analyzer executor. The subsequent Camera3-OutputStream broken-pipe messages are consequences of the app process dying, not the original failure.

The Android frame pipeline had two unsafe lifetime assumptions:

• Bitmap2Yuv420p pinned buffer.Remaining() bytes, then unconditionally read width * height * 4 bytes through pointers. An empty or partially consumed buffer could therefore dereference null or read past the managed array.
• Contiguous CameraX buffers were exposed through FrameReady while still backed by ImageProxy memory, even though ImageProxy.Close() ran immediately after the callback.

This change:

• copies every CameraX frame into owned managed memory before closing ImageProxy;
• preserves the public ByteBuffer frame API while letting the built-in decoder use the owned bytes directly;
• makes external ByteBuffer decoding non-mutating by reading from a reset duplicate;
• replaces unsafe pointer conversion with bounds-checked managed RGBA-to-luminance conversion;
• adds regression coverage for empty, undersized, padded, and valid frame buffers.

Validation

• All 63 unit tests pass.
• Android library builds in Release for net10.0-android with no warnings or errors.
• Signed Release APK published and run on an Android 15/API 35 emulator.
• CameraX Preview and ImageAnalysis remained active through a two-minute soak with no SIGSEGV, libsigchain, fatal exception, or camera broken-pipe signature.

The exact reporter app/device remains unavailable, so confirmation with the CI NuGet artifact is still requested.