Centralize HEIF/AVIF encoded output ownership

[gregbenz]

Why

HEIF/AVIF encoding currently keeps two output allocations alive when encoding finishes: the
writer's growable buffer and a separate uhdr_encode() result buffer reserved as
max(64 KiB, 6 * width * height). The encoded bytes are then copied from one buffer to the other.

This change lets the returned compressed image take ownership of the writer's allocation. That
removes the speculative result allocation and final copy, reducing peak memory use during
HEIF/AVIF encoding. It also allows valid output larger than the old estimate to succeed.

What changed

• Use the owned-output methods as the single implementation path for HEIF/AVIF encoding.
• Transfer the writer allocation only after a successful libheif write, using free-compatible
  cleanup without relying on C++ exceptions.
• Keep the existing fixed-buffer C++ overloads as checked adapters over the owned-output path.
• Leave owned output empty on failure and preserve caller-provided bytes and data_sz when a fixed
  destination is invalid or too small.
• Add focused API-0/API-1 AVIF and HEIF coverage for successful copies, failure behavior, output
  larger than the old estimate, buffer reuse, and null-data validation.

The public C API remains unchanged, and this does not change decoder behavior.

Testing

• Full HEIF-enabled suite: 1,087 passed; 224 expected editor tests skipped.
• Full HEIF-disabled suite: 1,069 passed; 224 expected editor tests skipped.
• Focused output/API tests: 25/25 passed.
• Focused ASan/UBSan ownership and output tests: 14/14 passed.
• Affected sources passed -fno-exceptions -Wall -Wextra -Wshadow -Werror.
• Public C-header, shared-export, legacy-source, and C++ symbol checks passed.