fix: use checked arithmetic in ICC tag parsing

[lilith]

Malformed ICC streams could trigger integer overflow when calculating tag offsets. This causes panics in debug builds and silent wraparound in release builds.

This uses checked_add/checked_mul to detect overflow and return InvalidIccStream instead.

Extracted from #602 as a standalone fix per review feedback.

[github-actions]

Benchmark @ 96d22c9

MULTI-FILE BENCHMARK RESULTS (4 files)
  CPU architecture: x86_64
  WARNING: System appears noisy: high system load (2.63). Results may be unreliable.
Statistics:
  Confidence:               99.0%
  Max relative error:        3.0%

Comparing: cdb20484 (Base) vs 22c76e2f (PR)

File	Base (MP/s)	PR (MP/s)	Δ%
bike.jxl	23.188	23.136	-0.22% ±2.9%
green_queen_modular_e3.jxl	8.126	8.125	-0.01% ±0.8%
green_queen_vardct_e3.jxl	20.248	20.270	+0.10% ±2.2%
sunset_logo.jxl	2.227	2.209	-0.83% ±0.4%