[vector] Cap serialized document size; un-conflate output from outline

The vector work budget charged both outline traversal and serialized
output bytes, and left embedded bitmaps entirely uncharged -- so a COLR
walk with many sweep-gradient or image layers could emit output that the
outline budget never sees, bounded only by the structural per-node caps
times the node count.

Bound the output with a flat document-size cap instead: hb_vector_buf_t
refuses to grow past HB_VECTOR_MAX_DOCUMENT_SIZE (16 MB) and folds that
into in_error(), so every emission site that already checks it -- path
commands, gradient meshes -- stops cleanly, and image embedding is bounded
for the first time.  clear() resets the sticky flag so a context reused
across renders (the documented clear -> paint -> render loop) recovers
after one over-cap glyph.  vector is one glyph per context, so a flat cap
suffices; SVG's whole document and PDF's (assembled through the same
hb_vector_buf_t) share it.

With output bounded structurally, the work budget goes back to pure
outline traversal: drop the per-command byte charge and the sweep-patch
charge so it no longer conflates two different resources.  It is still
needed on its own -- a CFF charstring can do a lot of work while emitting
little output.

Once the cap trips, remaining appends are dropped, so a truncated document
is malformed; render returns it (or null) rather than looping to build
gigabytes, which is the point.

Add a regression test that paints an oversized image and confirms the
document stays bounded and the context recovers on reuse; it fails if the
cap is removed.

Tests: meson test -C build (275/275 passed); the vector COLR regression
seed completes in 0.85s.

Assisted-by: Claude <noreply@anthropic.com>