ESP32-P4: fix ROM miniz collision, three malformed-input UB fixes, faster CRC/ECC

[rtissera]

Work from bringing libchdr up on a Waveshare ESP32-P4-NANO with a real SD card.
Three correctness fixes that apply everywhere, two decode optimisations that
apply everywhere, and a hardware benchmark harness under contrib/.

Everything here was measured on the board or found by fuzzing; nothing is
speculative.

Correctness

• ESP32 ROM miniz symbol collision. ESP ROMs export an older miniz whose
  absolute linker symbols outrank ours, so tinfl_decompress bound to the ROM
  copy and libchdr's zlib/cdzl decoding produced garbage. Verified with a
  direct link test: the ROM address wins and miniz's real decoder is never
  pulled from the archive. Renamed from the build glue, not by patching the
  vendored source.
• Huffman subtable arena was never reset between lookup-table rebuilds, so
  repeated builds leaked subtables and eventually decoded against a stale one.
• Three undefined shifts reachable from a malformed CHD, all pre-existing:
  a uint8_t promoted to int and shifted by 24 in the header parser;
  unvalidated lengthbits/selfbits/parentbits from the v5 map header
  reaching bitstream_read() and shifting by a negative amount; and a refill
  shifting by 32 once a stream has been over-consumed. Found by fuzzing under
  ASan/UBSan.
• dr_flac 0.13.4, which fixes a heap overflow when
  drflac__realloc_from_callbacks() shrinks a buffer and a discarded subframe
  decode result that let a failed frame report success.
• CHDR_WANT_RAW_DATA_SECTOR=OFF with CHDR_VERIFY_BLOCK_CRC=ON is now
  refused at configure time. The stored CRC covers the reconstituted hunk, so
  the combination can never verify, and it failed content-dependently - a
  hunk holding only audio frames has no ECC to regenerate and still passes -
  which read as sporadic file corruption.

Performance

Both are portable C, no intrinsics, no target-specific paths.

• crc16 slice-by-4. The byte-at-a-time loop is 12 instructions per byte on
  RV32 and runs over every decoded hunk under VERIFY_BLOCK_CRC - about
  0.76 ms per 19584-byte hunk on the P4, more than the zstd decode it was
  checking. Slice-by-4 takes it to 6.25, for 1536 bytes of extra tables.
• ECC P parity, four rows per 32-bit word. ecclow[] is exactly xtime()
  in GF(2^8) with poly 0x11d and poffsets[r][c] is exactly r + 86c, so the
  86 independent P rows pack into one accumulator. This is SWAR, not SIMD.

Measured, same 14 files, same configuration, uncapped over 7.32 GB:
2307 s -> 1925 s, 3.17 -> 3.80 MB/s. Per hunk on identical content,
5.087 -> 4.168 ms.

Measured elsewhere (aarch64 under qemu, so ratios rather than absolute times):

	x86-64 -O2	x86-64 -O3	aarch64 -O2	aarch64 -O3	RV32
crc16 slice-4	3.55x	3.52x	1.97x	2.42x	1.9x
ECC P SWAR	2.54x	2.70x	4.41x	4.54x	1.47x

Memory and API

• chd_set_cache_budget() adds an opt-in read-ahead window and a
  self-reference cache, both off by default - how much memory is available
  is a property of the embedding system, not of libchdr.
• The zlib codec drives tinfl directly with a non-wrapping output buffer,
  dropping the 32KB LZ dictionary mz_inflate allocates per instance.
• Under LOWRAM_TARGET, cdzs shares one ~93KB zstd context between sector data
  and subcode, which are never in flight at once.
• FLAC allocation failures report CHDERR_OUT_OF_MEMORY instead of being
  indistinguishable from a corrupt stream.
• With VERIFY_BLOCK_CRC on, dr_flac's per-frame CRC is skipped since the hunk
  CRC covers the same data - worth ~8% of a CD-FLAC hunk and 13KB of text on
  RV32. Detection is unchanged: over 25 corruption cases the builds with and
  without agree, with no corrupt output escaping.

Validation

• Decoded output byte-identical over 287 CHDs against the pre-change build,
  with VERIFY_BLOCK_CRC checking every hunk against chdman's own CRC.
• Identical across sequential, reverse, random and scattered-sample read
  orders; across LOWRAM_TARGET on/off, system zlib, system zstd and LTO; and
  between 32-bit and 64-bit builds.
• 3412 malformed inputs (mutations of all 17 corpus seed codecs plus
  structure-aware header cases) clean under ASan and UBSan against both map
  implementations and both word sizes; 546 metadata-chain inputs including
  self-referential cycles; API misuse including the OOM path. No leaks.
• AVHuff regression suite 4/4. Compiles clean for Cortex-M33 and Cortex-M0+.

Notes for review

contrib/esp32p4/ is a test harness, not library code, and can be dropped
without affecting anything else - the last two commits are the benchmark and
its documentation. Every commit builds on its own.

Supersedes #179, which carried the same work across 32 commits.