Security: Affinity import and brush expansion bounds (#3887)

* Audit: Affinity import (spot colour chain, zero-width records, corner radii)

* Audit: Affinity layer names are cut at 1024 characters

* Audit: brush expansion bounds (masks, library parsing, flattening), pressure profile lookup

* Brush: reach a node's mask through its extras

crates/affinity/src/stream.rs

@@ -303,6 +303,10 @@ impl Parser<'_> {
             0x2c => {
                 let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
                 let size = usize::from(self.c.u16()?);
+                // Records of no bytes take nothing from the data, whatever their number.
+                if n > 0 && size == 0 {
+                    return Err(Error::Malformed("array of records without bytes"));
+                }
                 if n.checked_mul(size).is_none_or(|b| b > self.c.remaining()) {
                     return Err(Error::Malformed("array longer than its data"));
                 }