Simplify decode() and validate UTF-8 continuation bytes

[yhirose]

Summary

Builds on #15 by @samhocevar, with one correctness fix added.

• Simplify & speed up decode() — remove the internal for_each() helpers (UTF-8 and UTF-16) and call decode_codepoint() directly. This drops the duplicated byte scan and speeds up decoding by roughly 20% (UTF-16) and 30% (UTF-8). The helpers were used nowhere outside decode().
• Validate UTF-8 continuation bytes in decode_codepoint(). Without the for_each() grouping, an invalid lead byte would consume the following bytes unconditionally — they were only masked with & 0x3F, never checked — and swallow trailing valid characters. Rejecting bytes that are not 0x80–0xBF makes decode() resync byte-by-byte and recover the following text.

Why the validation is needed

The bare simplification in #15 changes behaviour on invalid UTF-8 (valid input is unaffected):

input	before this fix	with continuation validation	ICU / Python / Rust / browsers
E0 41 42	B (swallows A, bogus cp)	AB	<U+FFFD>AB
F0 'Hello'	<U+896C>lo (swallows Hel)	Hello	<U+FFFD>Hello
E1 80 41	<U+1001> (swallows A)	A	<U+FFFD>A

Every mainstream decoder validates continuation bytes and never swallows the following valid characters. This change brings the resync behaviour in line with them. (The library still silently drops invalid bytes rather than emitting U+FFFD — that existing design choice is preserved; this PR is not a full Table 3-7 validator.)

Tests

Added regression tests (test/test.cpp):

• decode invalid utf8 resync — invalid lead bytes resync and recover the following text instead of swallowing it.
• decode_codepoint rejects bad continuation bytes — decode_codepoint() returns 0 on bad continuation bytes, and still accepts well-formed sequences.
• utf16 decode invalid resync — a lone high surrogate resyncs without swallowing the next unit.

These fail against the un-validated decode() and pass with the fix.

Verification

• Full test suite (including the new cases): all pass.
• ~500k random valid scalars, encode → decode round-trip: 0 failures (UTF-8 and UTF-16), so no regression on valid input.
• 100k fuzzed byte sequences vs Python's standard decoder (errors='replace', U+FFFD stripped): 98.3% exact match; every remaining difference is the library's pre-existing permissiveness (overlong / surrogate-encoded / out-of-range), with no unexplained mismatches.
• Builds clean under -Wall -Wextra -Wshadow.