feat(pdu,graphics): add ClearCodec bitmap compression codec

Add ClearCodec (MS-RDPEGFX 2.2.4.1) codec support across two crates:

ironrdp-pdu: Wire-format decode/encode for all ClearCodec layers
(residual BGR RLE, bands with V-bar caching, subcodec dispatch
including RLEX palette-indexed RLE). Full round-trip test coverage.

ironrdp-graphics: ClearCodecDecoder with persistent V-bar and glyph
caches. ClearCodecEncoder with residual-only encoding and glyph
deduplication for server-side bitmap compression.

Hardening pass before maintainer review (local fuzz oracles surfaced
three bug classes that escaped the initial review):

- Per-dimension cap at 8192 on decode, replacing the previous per-
  pixel-count cap at 8192*8192. The pixel-count form accepted
  degenerate aspect ratios (e.g. 63961x771 = 49M pixels, under the
  67M cap) that allocated ~197MB from a few attacker-controlled
  bytes. The per-dimension form rejects implausible tile shapes
  regardless of total area while preserving headroom for 8K
  displays (7680x4320). MS-RDPEGFX caps surfaces at 32767x32767
  but does not mandate a separate tile cap; 8192 is a defensive
  choice that fits realistic tile sizes.

- Fix integer overflow at bands::decode_band on
  `usize::from(x_end - x_start + 1)`. When x_end = u16::MAX and
  x_start = 0, the `+ 1` overflowed the u16 arithmetic before the
  usize cast and triggered a release-mode panic under
  overflow-checks. The existing `if x_end < x_start` guard
  prevents underflow but not the +1 overflow. Fix is to cast to
  usize first: `usize::from(x_end - x_start) + 1`.

- Document the alpha contract on ClearCodecEncoder::encode and
  ClearCodecDecoder::decode. ClearCodec is lossless on the three
  color channels (B, G, R) per spec; the wire format does not
  transmit alpha. The encoder reads B/G/R from each input pixel
  and discards alpha; the decoder fills alpha with 0xFF
  unconditionally. Callers needing alpha must transport it
  separately. Previously the doc-comment claim of "pixel-perfect
  fidelity" was ambiguous; alpha-channel mismatches in any
  round-trip with non-0xFF alpha inputs are by design, not bugs.

Local fuzz infrastructure (clearcodec_decode + clearcodec_round_trip
oracles) follows in a separate PR once this lands; the codec's
public API is already fuzz-friendly so no prep is needed here.

A separate spec-driven audit of input-validation completeness
(per-layer stream-length pre-checks in subcodec / residual /
bands) is queued as follow-up work; deferring from this PR pending
review of MS-RDPEGFX 2.2.4.1.

Closes #1158 ClearCodec subtask.

Author: glamberson

crates/ironrdp-graphics/src/clearcodec/glyph_cache.rs

@@ -0,0 +1,98 @@
+//! Glyph cache for ClearCodec (MS-RDPEGFX 2.2.4.1).
+//!
+//! When a bitmap area is <= 1024 pixels, ClearCodec can index it in a
+//! 4,000-entry glyph cache. On a cache hit (FLAG_GLYPH_HIT), the previously
+//! cached pixel data is reused without retransmission.
+
+/// Maximum number of glyph cache entries.
+pub const GLYPH_CACHE_SIZE: usize = 4_000;
+
+/// A cached glyph entry: BGRA pixel data with dimensions.
+#[derive(Debug, Clone)]
+pub struct GlyphEntry {
+    pub width: u16,
+    pub height: u16,
+    /// BGRA pixel data (4 bytes per pixel).
+    pub pixels: Vec<u8>,
+}
+
+/// Glyph cache for ClearCodec bitmap deduplication.
+pub struct GlyphCache {
+    entries: Vec<Option<GlyphEntry>>,
+}
+
+impl GlyphCache {
+    pub fn new() -> Self {
+        let mut entries = Vec::with_capacity(GLYPH_CACHE_SIZE);
+        entries.resize_with(GLYPH_CACHE_SIZE, || None);
+        Self { entries }
+    }
+
+    /// Look up a glyph by its cache index.
+    pub fn get(&self, index: u16) -> Option<&GlyphEntry> {
+        self.entries.get(usize::from(index)).and_then(|slot| slot.as_ref())
+    }
+
+    /// Store a glyph at the given index.
+    ///
+    /// Returns `true` if the index was valid and the entry was stored.
+    pub fn store(&mut self, index: u16, entry: GlyphEntry) -> bool {
+        let idx = usize::from(index);
+        if idx < GLYPH_CACHE_SIZE {
+            self.entries[idx] = Some(entry);
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Reset the entire glyph cache, removing all entries.
+    pub fn reset(&mut self) {
+        for slot in &mut self.entries {
+            *slot = None;
+        }
+    }
+}
+
+impl Default for GlyphCache {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn store_and_retrieve() {
+        let mut cache = GlyphCache::new();
+        let entry = GlyphEntry {
+            width: 8,
+            height: 16,
+            pixels: vec![0xFF; 8 * 16 * 4],
+        };
+        assert!(cache.store(42, entry));
+        let retrieved = cache.get(42).unwrap();
+        assert_eq!(retrieved.width, 8);
+        assert_eq!(retrieved.height, 16);
+    }
+
+    #[test]
+    fn get_empty_returns_none() {
+        let cache = GlyphCache::new();
+        assert!(cache.get(0).is_none());
+        assert!(cache.get(3999).is_none());
+    }
+
+    #[test]
+    fn reject_out_of_range() {
+        let mut cache = GlyphCache::new();
+        let entry = GlyphEntry {
+            width: 1,
+            height: 1,
+            pixels: vec![0; 4],
+        };
+        assert!(!cache.store(4000, entry));
+    }
+}