Fix/tiff readtiffentry uint32 overflow

[blackcaesar0]

readTiffEntry: offset bounds check wraps on overflow

description:
baseOffset() and offset are both uint32_t so when you add them the
result can wrap. If it wraps to something below size_ the check passes
and pData ends up pointing past the buffer — Value::read() then reads
from memory it has no business touching.

On 64-bit the uintptr_t guard at line 1612 usually saves you. On 32-bit
That guard is the same width so it wraps just the same, Value::read()
dereferences the bad address and you get heap corruption and a SIGSEGV.
I ran into this through kioslave5 crashing on certain JPEGs.

Cast both sides to uint64_t before the addition — wide enough that the
sum of any two uint32_t values can't wrap. I also dropped the second
condition (static_cast<int32_t>(baseOffset()) + offset <= 0) because
the cast doesn't actually change the arithmetic, it just catches the
exact wrap-to-zero case and nothing else.

lines related: #193, #1536