[ Reason ]
Fix CVE-2026-35444 and various other out-of-bounds accesses when parsing
malformed/crafted image files

[ Impact ]
If not fixed, games/applications that load untrusted images using
SDL3_image could be subject to denial-of-service (crash) or possibly
exploitable.

[ Tests ]
autopkgtest (automated smoke-tests loading images in various formats)
passes, and the showimage sample program from libsdl3-image-tests can
load various images on a trixie GNOME desktop. I didn't attempt to
obtain malformed/crafted images designed to exploit the robustness
issues.

[ Risks ]
Low risk, hardly anything in trixie uses libsdl3-image: I believe it's
only freerdp-sdl, a developer-oriented RDP client with low popcon, which
uses it to load images into dialogs.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
All changes are robustness fixes from upstream. Most are fixed in 3.4.2
or 3.4.4 upstream. One is not in an upstream release yet, I backported
it into forky already.

[ Other info ]
Related to https://bugs.debian.org/1134510 for libsdl2-image, an older
branch of the same codebase.

debdiff attached, also in
<https://people.debian.org/~smcv/13.7/libsdl3-image/>.

A functionally-equivalent test build (differing only in the changelog)
is in <https://people.debian.org/~smcv/13.7/libsdl3-image/testbuild/>.

     smcv