security: add bounds checks to decoder prediction schemes and point count

[sharadboni]

Summary

This PR fixes five heap-buffer-overflow and negative-integer vulnerabilities
in the Draco 3D decoder discovered through security analysis.

Vulnerabilities 1–4: Ignored size parameter in mesh prediction scheme decoders

The ComputeOriginalValues method in four mesh prediction scheme decoders
(MeshPredictionSchemeParallelogramDecoder,
MeshPredictionSchemeConstrainedMultiParallelogramDecoder,
MeshPredictionSchemeMultiParallelogramDecoder,
MeshPredictionSchemeGeometricNormalDecoder) had the size parameter
commented out (int /* size */) and used corner_map_size from mesh data
as the loop bound instead.

When corner_map_size > size / num_components, the loop writes past the end
of out_data, causing a heap buffer overflow. The corner map and attribute
arrays are both populated from compressed data, so an attacker can craft a
DRC file where they diverge.

Fix: Restore the size parameter and add a guard:

if (corner_map_size * num_components > size) {
  return false;
}

Vulnerability 5: Negative point count in PointCloudSequentialDecoder

DecodeGeometryData reads num_points as int32_t from the bitstream
without checking for negative values. A negative value implicitly converts
to a very large uint32_t when passed to set_num_points, causing
downstream heap overflow.

Fix: Reject negative point counts:

if (num_points < 0) {
  return false;
}

Testing

All 25 existing .drc test files in testdata/ decode correctly with the
fixed decoder under AddressSanitizer.