Fix remaining image and URL parser denial-of-service paths

[Neel2107]

Malformed image headers can hang Metro, and malicious encoded URL input can exhaust CPU in the Expo Router dependency chain. This change guards ICNS/BMFF parser progress and upgrades the decoder to 0.5.0 with the CommonJS import adaptation query-string needs. A further decoder patch processes distinct encoded runs once, eliminating the remaining repeated-rescan fallback.

The three version-specific patches apply during npm postinstall with errors treated as failures. CI performs a clean install and runs the security regression suite. Package identities and published versions are preserved.

Validation:

• Clean npm ci applies all three patches successfully.
• All 31 security and compatibility tests pass, including bounded malformed-input subprocesses, valid image formats, Unicode, and query round trips.
• Android and iOS production bundles export successfully.
• The decoder patch also passes all 135 upstream test cases; independent review found no blocking issues.
• Physical-device behavior was not tested.

Dependabot status: the decoder upgrade should close its alert. The two image-size alerts may remain because scanners see upstream 1.2.1, not the locally applied guards, and upstream has no published fixed release. These alerts are intentionally not dismissed. npm audit currently reports image-size and its transitive Metro parents only. Patch rationale and removal guidance are documented under patches/.