Harden PE resource parser against malformed/truncated input and binary-field misreads

[Copilot]

This PR hardens src/pe_resource_loader.c for untrusted PE input by eliminating unchecked I/O/allocation paths and validating file-derived offsets/sizes before use. It also fixes binary-field comparison bugs (PE\0\0, .rsrc name) and closely related correctness/memory issues exposed by these changes.

• Parser I/O and allocation hardening

  • Added checked read/seek/range helpers and applied them across PE/header/resource parsing paths.
  • Added allocation-result checks before dereference/use in all touched paths.
  • Made cleanup resilient to partial initialization and error unwinds.

• Binary field correctness (no string semantics on fixed-width data)

  • Replaced NT signature string comparison with exact 4-byte signature comparison.
  • Replaced .rsrc section-name string logic with exact 8-byte section-name matching.

• Offset/size validation and overflow guards

  • Validated DOS/NT/resource-derived offsets and section table spans against actual file size.
  • Added arithmetic overflow/underflow guards for offset math and size composition.
  • Added sane upper bounds (e.g., section/resource-name/language collection paths) and prevented MAX_LANG_COUNT overrun.

• Unsafe stack allocation removal and related fixes

  • Replaced file-sized UTF-16 VLA in resource-name parsing with bounded heap allocation.
  • Fixed BMP header detection bug (BM byte check) and tightened bitmap/cursor/icon processing for invalid/short payloads.
  • Fixed memory-management issues in touched paths (including leaked directory-entry buffers).

• Targeted hardening coverage

  • Added a focused C test (tests/hardening_test.c) integrated with CMake/CTest to cover malformed/truncated open paths and bitmap edge behavior.

/* Before: string semantics on binary PE signature */
if (strcmp((char *) nt_signature, EXPECTED_NT_SIGNATURE) != 0) { ... }

/* After: exact fixed-width binary comparison */
static const uint8_t expected_nt_signature[4] = { 'P', 'E', 0x00, 0x00 };
if (memcmp(nt_signature, expected_nt_signature, 4) != 0) { ... }

[sharkwouter]

This is mostly a test to see how copilot works, before I use it to do more serious work. I know there are some code paths which could make pe-resource-loader do things it is not supposed to when a maliciously wrong/corrupted pe file is given to it. So this seemed like a good test to me.