fix(canvas): avoid double-free when ImageData pixel buffers are collected - #149

Brings in #144-#149. Conflict resolution notes:

* #147 (V8 14 native bridge) overlapped almost entirely with the V8 14
  migration this branch already carries. Both sides fix the same API break;
  master does it with dual-version shims (canvas::GetAlignedPointer,
  canvas::Receiver, CANVAS_FAST_FUNCTION, #if V8_MAJOR_VERSION >= 14) so one
  tree can build against V8 10.3 and 14, while this branch targets a single
  vendored V8 14.9 (tools/scripts/download-v8.sh) and calls the native APIs
  directly. 118 of the 127 conflicting sources were that difference alone --
  after rewriting master's shims into this branch's idiom, 112 compared
  byte-identical -- so those keep this branch's spelling and the now-unused
  shim block is dropped from Common.h.

* Master's shims also compile fast API calls out on V8 >= 14
  (CANVAS_FAST_FUNCTION -> v8::CFunction{}, c_function -> nullptr). V8 14.9
  still declares both FunctionTemplate::New(..., const CFunction*) and
  NewWithCFunctionOverloads, and this branch's fast paths are built against
  it, so taking that would have silently disabled every fast call in the
  binding layer. Helpers.h keeps this branch's version; the four
  CANVAS_FAST_FUNCTION call sites that auto-merged into
  OES_vertex_array_objectImpl and WEBGL_draw_buffersImpl -- no conflict was
  raised for those -- are restored to v8::CFunction::Make.

* Master's *Array fast overloads are all guarded #if V8_MAJOR_VERSION < 14,
  so they are dead on 14 and equivalent to this branch having removed them.

* #149 (ImageData double free) applies unchanged. canvas_native_image_data_get_data
  borrows its argument and returns a U8Buffer holding a second refcounted
  handle to the same pixels, so ImageDataBuffer must release only the buffer --
  ~ImageDataImpl already releases the ImageData. The comment is reworded from
  master's, which described the buffer as owning a clone of the pixel storage;
  it is a shared handle, and that is what makes the JS data view live.

* Package versions stay on the 3.0.0-alpha line.
* canvas-release.aar keeps this branch's binary; it predates the Android
  render fixes in 638a265 and needs rebuilding from the merged sources.

… them in CI

Nothing in CI ran tests, and the four crates that already had #[test]
modules could not be built on the host at all, so none of them had ever
executed. With the canvas-core build fixed they do; `make test` and two new
CI jobs run them.

ImageData ownership (crates/canvas-c/src/c2d/image_data.rs)
  ImageData is a manually refcounted handle -- Clone copies the raw pixel
  pointer and bumps an Arc, and the storage is freed only when the last
  handle drops. canvas_native_image_data_get_data borrows and hands back a
  second handle to the same pixels, which is what makes the JS `data` view
  live and what #149 turned on. The tests pin all three parts: the buffer
  aliases the ImageData's pixels, releasing the buffer leaves the ImageData
  usable (the double free #149 fixed), and the buffer keeps the pixels alive
  when the ImageData handle is dropped first.

V8 bridge invariants (tools/tests/check-v8-bridge-invariants.py)
  Static checks over the bridge sources for things the compiler accepts but
  that break at runtime or silently cost performance: internal-field and
  external-pointer accessors that are missing their V8 14 tag (an untagged
  read returns null rather than failing to build), V8 14-removed APIs coming
  back, dual-version shims re-entering a branch that ships one vendored V8,
  and the overload helper regressing to a bare pointer -- which is exactly
  how 23 of the 41 fast-call overloads went unregistered. Both of the
  regressions this merge introduced by auto-merge would have been caught
  here.