Remove most unchecked size/index casts

Convert most unchecked size/index `as` casts to checked casts with
`TryFrom`, included another top-level error variant.

This has several motivations:
- Making the library as robust as possible, including to platform
differences.
- Unchecked casts are susceptible to breakage during refactorings.
- Preparing for BigTIFF support, which will require the introduction of
generics and associated types for some parts of the de/encoders.
Unchecked primitive casts cannot be bound, while TryFrom can, and
overflowing conversions become more likely.
- Remaining u16 casts may be prone in failure in existing practice and
not just in theory during future changes.

src/error.rs

@@ -22,6 +22,10 @@ pub enum TiffError {
 
     /// The Limits of the Decoder is exceeded.
     LimitsExceeded,
+
+    /// An integer conversion to or from a platform size failed, either due to
+    /// limits of the platform size or limits of the format.
+    IntSizeError,
 }
 
 /// The image is not formatted properly.
@@ -171,6 +175,7 @@ impl fmt::Display for TiffError {
             ),
             TiffError::IoError(ref e) => e.fmt(fmt),
             TiffError::LimitsExceeded => write!(fmt, "The Decoder limits are exceeded"),
+            TiffError::IntSizeError => write!(fmt, "Platform or format size limits exceeded"),
         }
     }
 }
@@ -182,6 +187,7 @@ impl Error for TiffError {
             TiffError::UnsupportedError(..) => "Unsupported error",
             TiffError::IoError(..) => "IO error",
             TiffError::LimitsExceeded => "Decoder limits exceeded",
+            TiffError::IntSizeError => "Platform or format size limits exceeded",
         }
     }
 
@@ -217,5 +223,11 @@ impl From<TiffUnsupportedError> for TiffError {
     }
 }
 
+impl From<std::num::TryFromIntError> for TiffError {
+    fn from(_err: std::num::TryFromIntError) -> TiffError {
+        TiffError::IntSizeError
+    }
+}
+
 /// Result of an image decoding/encoding process
 pub type TiffResult<T> = Result<T, TiffError>;