The interface for `fsst_import` relies on being passed a pointer to a
well-formed, valid header that was generated by `fsst_export`. Passing
it a corrupted header can easily lead to out-of-bounds accesses.

The same is true for `fsst_decompress`, albeit to a lesser extent. The
function already takes care of not writing past the end of `output`, but
it can read past the end of `strIn` if the last byte of the compressed
string is (erroneously) an escape byte. In practice, this will only be
the case if the compressed data is corrupted.

I'm using FSST in a file system implementation and I'm currently in the
process of hardening the implementation against out-of-bounds accesses
wherever possible. For "trusted" file system images, internal checksums
take care of corruption / bit-rot. But for "untrusted", potentially
malicious, images with forged checksums, I'd like to make sure to catch
all errors that could lead to OOB accesses during a full file system
check. The `fsst_validate_header()` call is cheap enough to be always-on.

In order to not impact API and/or performance, the validation checks are
implemented as separate functions that can be called on demand.