Make pbf_reader actually provide the strong exception guarantee

[kkaefer]

Our docs promise that a method that throws leaves the reader unchanged. However, this is not true currently because several methods advanced the reader before all checks had passed:

• next() on tag 0, a reserved tag, or an unknown wire type
• skip(), get_view(), get_message() on a truncated length-delimited field
• get_packed_*() on a truncated last varint or a fixed length that isn't a multiple of the element size
• next(tag) / next(tag, type) when a field after one they've already skipped is invalid

For fixing this, we are now decoding and validating the length on a temporary pointer (peek_length_delimited()), and only move the reader (with consume_until()) after every check has passed. Same for next(), which writes tag, wire type and position only after validating them. next(tag) works on a copy of the reader because it calls many different functions (like skipping) that modify the state as it tries to find the next matching tag.

I also added new unit tests (test_exception_guarantee.cpp) for each case with manually constructed adversary protobuf files, and tested locally with ASan/UBSan. I couldn't find a measurable performance change in the vector-tile decode benchmarks, all the runs were within measurement inaccuracy.

[kkaefer]

FWIW, I don't think this is a huge problem in practice because if we throw an exception due to malformed file (or badly written reader), I'd expect most client apps would abort the entire parse anyway, so it doesn't really matter that the reader is now in an invalid state.