Reject unsupported bit depths in load_png

[Nashit-h]

1. load_png reads bit_depth from IHDR and builds the buffer as halide_type_t(halide_type_uint, bit_depth), but selects the row reader with bit_depth == 8 ? read_big_endian_row<uint8_t> : read_big_endian_row<uint16_t>.
2. PNG also allows bit depths of 1, 2 and 4, which land on the uint16_t reader while png_get_rowbytes and the image allocation are both sized for one byte per element.
3. A 64x8 4-bit grayscale file reads 128 bytes out of a 32-byte row buffer and writes 1024 bytes into a 512-byte allocation, which ASan reports as a heap-buffer-overflow in read_big_endian_row.

query_png only ever advertised 8- and 16-bit samples, so the loader now screens the depth up front, the same way load_pnm already screens maxval.

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[alexreinking]

Thanks for the patch!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@10162e8). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9212   +/-   ##
=======================================
  Coverage        ?   69.51%           
=======================================
  Files           ?      255           
  Lines           ?    78523           
  Branches        ?    18774           
=======================================
  Hits            ?    54582           
  Misses          ?    18205           
  Partials        ?     5736           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.