Bound Android Binary XML reads to declared chunks ##crash

[trufae]

Follow-up to #26931: the decoder still accepted strings and node data from outside their declared chunks, including trailing input beyond the XML size.

• Validate complete chunks against the XML boundary; respect header sizes, attribute offsets/strides, and the resource map's actual payload length.
• Resolve strings relative to their own pool and bound offsets, UTF-8/UTF-16 length prefixes, contents, and terminators to its string-data region. Use RStrs for bounded prefix advancement.
• Borrow validated UTF-8 strings and static resource names. Reuse RStrBuf scratch buffers for UTF-16 conversion, formatted values, and qualified attribute keys, removing strdup and per-attribute string cleanup from the decoder. Resolve the namespace prefix once per element.
• Reject invalid string references and duplicate pools. Discard partial pFAj output when decoding fails.
• Use bounded input views instead of allocating/copying pools, elements, and namespaces. Production code is 105 lines shorter.
• Add 54 self-contained r2r cases covering both pFA and pFAj, including >64KB pools, extended lengths, short chunks, all string-lookup callers, repeated long/short attributes, scalar values, and invalid references after successful output. Change the two existing malformed-input unit tests to require rejection.

Validation: normal and ASan builds pass; all 54 command cases and five existing AXML unit tests pass in both builds. Three real APK manifests decode successfully, and 20,000 deterministic mutations in both output modes complete without ASan errors. git diff --check and sys/lint.sh --all pass. ASan runs used detect_leaks=0 because LeakSanitizer cannot inspect process tasks in this environment.