fix: prevent shift overflow panic in ColorMap size validation

`1usize << bits_per_sample` panics when bits_per_sample >= 64.
Use checked_shl to return a LimitsExceeded error instead.

Found by fuzzing decode_comprehensive with a BE TIFF containing
PhotometricInterpretation=RGBPalette and BitsPerSample=83.

src/decoder/image.rs

@@ -454,8 +454,9 @@ impl Image {
             match tag_reader.find_tag(Tag::ColorMap)? {
                 Some(v) => {
                     let map = v.into_u16_vec()?;
-                    let expected_len = 3usize
-                        .checked_mul(1usize << bits_per_sample)
+                    let expected_len = 1usize
+                        .checked_shl(bits_per_sample as u32)
+                        .and_then(|n| n.checked_mul(3))
                         .ok_or(TiffError::LimitsExceeded)?;
                     if map.len() != expected_len {
                         return Err(TiffError::FormatError(