reject unsupported bit depths in load_png

[soma0212]

load_png picks the row reader from bit depth without checking it is one the loader actually supports:

• libpng reports bit_depth 1/2/4 for sub-byte grayscale and palette PNGs and keeps a packed row, so png_get_rowbytes() is only ceil(width*bit_depth/8) bytes
• anything that is not 8-bit takes the read_big_endian_row<uint16_t> path, which reads 2 bytes per pixel past the packed row buffer and stores 16-bit samples into a buffer whose element size is 1 byte for the 1-bit halide type
• reachable from any caller that loads an untrusted PNG; ASAN flags a heap-buffer-overflow read in read_big_endian on a 1-bit file

Reject bit depths other than 8 or 16 up front, which is what query_png() already advertises, so valid 8- and 16-bit files are unchanged. Added a regression test that writes a 1-bit PNG and checks the load returns false instead of running off the row.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.29%. Comparing base (faa3500) to head (e882789).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9229      +/-   ##
==========================================
+ Coverage   70.13%   70.29%   +0.16%     
==========================================
  Files         255      255              
  Lines       78895    78895              
  Branches    18865    18865              
==========================================
+ Hits        55332    55460     +128     
+ Misses      17866    17832      -34     
+ Partials     5697     5603      -94     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[alexreinking]

@soma0212 — Can you please rebase on main?

[soma0212]

Rebased on main. Only conflict was with #9219, which added its test at the same spot in image_io.cpp; kept both tests. Re-ran the 1-bit repro under ASAN against the rebased header to be safe: still rejected cleanly, and 8/16-bit loads are unchanged.