PDF: throw on reads from an unauthenticated encrypted file

[andiwand]

Stacked on #527.

Reading an encrypted file without an installed decryptor previously served undecrypted bytes silently. This guards read_object / read_object_stream so they throw instead.

Changes

• New UnauthenticatedReadError exception (no existing exception covered this — FileEncryptedError/NotEncryptedError are different concepts).
• Both read paths throw it when is_encrypted() && !is_authenticated().
• New DocumentParser::is_authenticated() (encrypted and a decryptor installed).
• m_is_encrypted is now set only after the /Encrypt dictionary is resolved during construction. That resolution runs before any decryptor exists, so setting the flag earlier would trip the new guard on every encrypted file's open.

Why it's safe

• Construction (read_trailer_chain, xref streams) runs before m_is_encrypted is set → guard passes, xref streams stay raw (ISO 32000-1 7.5.8.2).
• Compressed objects route through a used-entry read and read_object_stream, so they're covered transitively.
• The normal render path authenticates via create_parser(m_decryptor) before parse_document(), so it's unaffected.
• The only newly-throwing path is bypassing auth, which previously produced garbage.

Test

DocumentParser.read_without_authentication_throws opens the public RC4 fixture without authenticating, asserts is_encrypted() / !is_authenticated(), and expects parse_document() to throw UnauthenticatedReadError. Uses only the public fixture, so it runs in CI without the private submodule.