feat(jpeg): preserve/expose XMP metadata, Extended XMP, and uhdr_strip_gain_map

[DichenZhang1]

Summary

This PR completes end-to-end JPEG XMP metadata preservation, Adobe XMP Part 3 Extended XMP support, namespace-aware XMP merging, and lossless gain-map stripping (uhdr_strip_gain_map) across libultrahdr.

Key Changes

1. Preserve & Expose JPEG XMP Metadata Across Encode and Decode (uhdr_enc_set_xmp_data, uhdr_dec_get_xmp):

   • Preserves caller-supplied and base-image XMP metadata across API-0 through API-4 JPEG encoding workflows.
   • Exposes the primary image's XMP metadata (with Extended XMP reassembled into the primary <rdf:RDF> packet) via uhdr_dec_get_xmp.
   • Unifies JPEG segment header/limit constants (kJpegMaxSegmentLength, kMaxStandardXmpPayload, kMaxExtendedXmpChunkPayload, kExtendedXmpHeaderSize) in jpegr.h.

2. Adobe XMP Part 3 Multi-Segment Extended XMP Support (> 65,503 Bytes):

   • Supports arbitrary-sized XMP payloads up to kMaxTotalXmpBytes (16 MiB) by splitting payloads larger than 65,503 bytes into 65,458-byte http://ns.adobe.com/xmp/extension/\0 APP1 chunks linked by an upper-case 32-hex-character MD5 digest (xmpNote:HasExtendedXMP).
   • Reassembles multi-segment Extended XMP chunks in JpegDecoderHelper with strict validation (MD5 format, consistent total_length, out-of-order and duplicate identical chunk handling, and rejection of conflicting/overlapping/incomplete chunks).
   • Handles the near-limit Standard XMP boundary (~64.9 KB – 65,503 B) when kWriteXmpMetadata (-DUHDR_WRITE_XMP=ON) is active: if merging the Ultra HDR Container:Directory pushes a standard-sized user XMP packet over kMaxStandardXmpPayload (65,503 bytes), JpegR::appendGainMap spills the unmerged user XMP cleanly into Extended XMP chunks and writes only the Ultra HDR primary XMP + xmpNote:HasExtendedXMP GUID into the Standard XMP segment (avoiding duplicate Container:Directory entries). uhdr_encode sizes xmpAllowance to accommodate both the Standard XMP segment and Extended XMP chunk headers.

3. Namespace-Aware Primary XMP Merging (MergePrimaryXmp in jpegrutils.cpp):

   • Replaces fragility of raw prefix/substring matching (find("</rdf:RDF>")) with a namespace-aware XML token/span parser (XmpMergeXmlHandler built on image_io::XmlReader).
   • Safely preserves custom namespace prefixes (<r:RDF>, <x:xmpmeta>), <?xpacket?> processing instructions, XML comments, CDATA sections, and non-primary descriptions (rdf:about="http://...", rdf:ID, rdf:nodeID), while replacing stale primary-image Container:Directory and hdrgm:Version attributes/elements.
   • In ISO-only mode (kWriteXmpMetadata == false), API-4 (encodeJPEGR(sdr_intent_compressed, gainmap_compressed, metadata, dest)) passes through the base JPEG's XMP byte-for-byte without injecting redundant GContainer / hdrgm properties.

4. Lossless Gain-Map Stripping Public C API (uhdr_strip_gain_map):

   • Adds UHDR_EXTERN uhdr_error_info_t uhdr_strip_gain_map(uhdr_compressed_image_t* in_stream, uhdr_mem_block_t* out_stream) in ultrahdr_api.h and JpegR::stripGainMap in jpegr.cpp.
   • Losslessly copies the primary SDR JPEG bitstream (SOI..EOI, including DRI and RST0..RST7 restart markers in entropy-coded scan data) without re-encoding pixels.
   • Removes the APP2 MPF directory segment, APP2 ISO 21496-1 segment, and everything after the primary image's EOI marker (secondary gain-map JPEG stream and any trailing container bytes).
   • Sanitizes the Standard XMP APP1 segment via stripGainMapFromXmp: strips Container (http://ns.google.com/photos/1.0/container/), Item (http://ns.google.com/photos/1.0/container/item/), hdrgm (http://ns.adobe.com/hdr-gain-map/1.0/), and apdi (http://ns.apple.com/HDRGainMap/1.0/) properties while preserving all unrelated user XMP attributes/elements (dc, xmp, exif, GCamera:MicroVideo, xmpNote:HasExtendedXMP, etc.). Drops the Standard XMP APP1 segment completely if it only contained generated gain-map metadata.

5. Fuzzer & Unit Test Coverage:

   • Added uhdr_strip_gain_map and uhdr_dec_get_xmp calls to ultrahdr_dec_fuzzer.cpp and ultrahdr_enc_fuzzer.cpp without altering FuzzedDataProvider consumption order.
   • Added unit tests in jpegr_test.cpp, jpegdecoderhelper_test.cpp, and ultrahdr_api_test.cpp covering:
     • Namespace-aware XMP merging with custom prefixes, comments/CDATA, non-primary rdf:about descriptions, stale Container:Directory replacement, and rejection of malformed/unsupported XML constructs
     • Near-limit Standard XMP (65,200 bytes) spilling cleanly into Extended XMP in -DUHDR_WRITE_XMP=ON mode (NearLimitStandardXmpSpillsCleanlyToExtendedXmp)
     • Extended XMP multi-segment encoding, decoding, out-of-order reassembly, duplicate identical chunks, and malformed/conflicting chunk rejection
     • uhdr_strip_gain_map on synthetic and real-world fixtures (apple_gainmap_new.jpg, apple_gainmap_old.jpg), verifying byte-identical primary entropy scan preservation, EXIF/ICC/Extended XMP retention, trailing trailer removal, and corrupt marker rejection

Test Plan

• Built and ran ultrahdr_unit_test in both CMake configurations:
  1. Default ISO mode (-DUHDR_BUILD_TESTS=ON -DUHDR_WRITE_ISO=ON -DUHDR_WRITE_XMP=OFF): All UltraHdrApiTest (21/21), JpegRTest, and JpegDecoderHelperTest suites pass.
  2. Legacy XMP + ISO dual mode (-DUHDR_BUILD_TESTS=ON -DUHDR_WRITE_ISO=ON -DUHDR_WRITE_XMP=ON): All UltraHdrApiTest (26/26), JpegRTest (34/34), and JpegDecoderHelperTest (17/17) suites pass.