Add missing upper-bound validation for glTF bufferView/buffer indices - #1247

Five sites indexed model.accessors[] with attacker-controlled indices,
checking only < 0 (or nothing). A malicious glTF with out-of-range
accessor indices causes a heap out-of-bounds read via
std::vector::operator[].

This adds the missing >= size() checks to:
- GltfDecoder::DecodePrimitiveAttributeCount
- GltfDecoder::DecodePrimitiveIndicesCount
- GltfDecoder::DecodePrimitiveIndices (else branch)
- GltfDecoder::DecodePrimitive (attribute loop)
- GltfDecoder::DecodeSkin (inverseBindMatrices)

Follows the same pattern as the bufferView/buffer fix (ab77d8c).

9 additional sites with missing upper-bound checks for attacker-controlled
indices:
- node.mesh -> meshes[] (4 sites): only checked >= 0
- scene.nodes[i] -> nodes[] (2 sites): no validation
- node.children[i] -> nodes[] (1 site): no validation
- node_index params -> nodes[] (2 sites): no validation

Same bug class as bufferView/buffer/accessor fixes.

2 additional sites:
- texture_index -> textures[]: only checked < 0
- input_texture.sampler -> samplers[]: only checked >= 0

Same OOB bug class.

2 sites checked upper bound but not < 0, allowing negative index OOB.

4 sites where buffer byte offsets were used without validation,
allowing OOB read via memcpy/pointer arithmetic.

- Check for overflow in accessor.count * num_components
- Reject negative accessor.count before vector resize