fix: decode indexed PixMaps in PICT BitsRect opcodes

[benletchford]

Summary

• decode indexed PixMap forms of PICT BitsRect and BitsRgn opcodes
• preserve inline color tables for destination palette mapping
• recognize the same form while scanning and measuring PICT streams
• stop safely when a reserved opcode declares an overflowing payload length

Root cause

BitsRect and BitsRgn were always parsed as one-bit BitMaps. PICT v2 also permits an indexed PixMap when the high bit of rowBytes is set, so the decoder skipped the PixMap header and color table and then interpreted image bytes as later opcodes.

Validation

• cargo fmt --check
• cargo test --lib trap::pict::tests (31 passed)
• regression coverage for an unpacked indexed PixMap BitsRect
• regression coverage for reserved-opcode length overflow

Closes #606

[benletchford]

Superseded by #607, which preserves the general unpacked BitsRect path and now also includes bounded opcode scanning and stream-synchronization coverage.