fix(imaging): Release a decoded image when nothing displays it - #25124

…ancellation (port of unoplatform#25124 amendments)

Ports the amendments made to unoplatform#25124 on master onto the 6.8 image release
fix (c13eba7, f443e7c).

Ownership travels with the result: ImageData gains IsShared and
AsShared(), a BitmapImage marks the result of a load that went through
the shared bitmap cache as shared on the task every sharer awaits, and
ReleaseSurface skips shared data itself. The source-wide SharesImageData
flag and the ReleaseAbandonedImageData partial are gone, so a cached
surface is never released by one of its sources no matter which open of
that source handles it, and a URI requester cancelled out of its wait
always attaches the releasing continuation (a no-op for shared data).
ReleaseImageData cancels the open in flight before releasing. On 6.8
ReleaseSurface lives in ImageSource.crossruntime.cs with a Skia-only
body, since that file also compiles for WebAssembly and Reference;
ImageSource.skia.cs is removed.

The cache is consulted only when caching is enabled and the source does
not ignore it (already the 6.8 shape), so a source that owns its decode
is never handed a shared one.

The Skia Image subscribes to a bitmap source only while loaded, and
OnLoaded subscribes again, so a recycled container's new source is not
decoded off-tree.

ImageSource.UnloadImageData releases the decoded data instead of just
dropping it, so a UriSource change on an opened bitmap releases the
previous decode (native Android/iOS keep the plain reset).

A stream load superseded while decoding releases the surface it produced
and drops the result instead of raising ImageOpened and taking the pixel
size of a stream the source no longer has.

The Given_BitmapImage runtime tests load their Images through a loaded
panel, as an unloaded Image no longer subscribes.

unoplatform#25114

… tip

The test counters are incremented with Interlocked (the decode and the releasing continuation run on
thread-pool threads), and the cache test unloads both cache-on requesters before asserting that the shared
surface is not released, as the unoplatform#25124 branch does now that a cached entry is only evicted when its load fails.

With the bitmap cache on, the decode shared by the BitmapImages that
load the same uri and decode size was owned by an LRU of
MaxBitmapImageCacheCount (100) entries. No source released it, and the
LRU kept it whether or not anything displayed it. An entry the LRU
evicted, or a shared load whose requesters were all cancelled, was left
to finalization (unoplatform#25128).

A shared decode now counts its uses: the opens waiting for it, and the
sources whose subscribers draw it or were given it to draw. Once it has
none, it waits on the same pending-release list as the decodes sources
own (1 s and MaxUndisplayedImageBytes, oldest first). When released, its
frames are freed and it leaves the cache, and a source that still holds
it opens again on its next subscriber. It keeps its pixel size, which an
Image showing that source measures with until then, as for the decodes
sources own.

An open hands its use over to its source once the source counts its own
use. Any other way out of the open (cancelled, failed, superseded, a
handler that throws) ends it, so nothing can release the result in
between, and nothing keeps it for good. A load whose requesters were all
cancelled keeps running for later ones, as since unoplatform#25101, and its result
then waits like any other.

The sharing follows WinUI's ImageCache, which leaves the provider's
store once the last BitmapImage using it lets it go (MUX Reference:
ImageProvider::EnsureCacheEntry, ImageProvider::RemoveImageCache). Like
that store, the cache does not own its decodes. An ImageBrush keeps its
subscription for its lifetime, so a source can be collected while it
still counts as a user. Sources are therefore held weakly, and a
collected one is dropped the next time the decode's uses change.

A subscriber that comes back still drawing a shared decode its source
replaced while it was away uses it again until it draws what replaced
it, as unoplatform#25124 lets it take back replaced pixels it owns.

The LRUCache helper had no other user and is removed.
MaxBitmapImageCacheCount no longer bounds anything; the next commit
marks it obsolete.

Shared decodes are kept while something draws them or was given them to
draw: while either of two sharing sources shows one, and for a moved
Image, an Image a re-entrant change skipped, one that comes back while
the replacement downloads, a drawn brush, an Image that left between
delivery and measure, and a collapsed Image. Once nothing does, they are
released on the same list and limit as owned decodes, and opened again
from one new decode.

An open superseded while taking its pixel size, or whose ImageOpened
handler throws, gives up its shared result, as does a shared load whose
requesters were all cancelled, a brush given another ImageSource, and a
source an ImageOpened handler switched away from. A source collected
while subscribed keeps no decode in the cache, alone or shared with a
live one, and does not hide the live one's use.

A released download is decoded again from its encoded bytes, unless the
response was unsuccessful, redirected (desktop), or said no-store,
no-cache or max-age=0. The encoded cache drops the least recently used
image once full, bytes unused past the expiry, and what a lowered bound
or a disabled cache no longer allows. On WebAssembly, where a test
cannot listen, a stand-in for fetch serves the image and counts its
requests.

Two tests from unoplatform#25124 assumed a shared decode is never released: the
within-delay one now waits with a long delay instead of a limit of 0,
and the cache-off one also checks that the shared decode goes, on a
decode size of its own. The failed-source test also checks the release
with the cache on.

Port of unoplatform#25124's bfa20af and 129365e, with the
part of unoplatform#25559's fc608f4 that keeps a released shared decode's size.
An auto-sized Image showing a source that released its pixels, because
nothing displayed them for the release delay, laid out at 0×0 until the
source decoded them again. With the bitmap cache off, a URI downloads
again meanwhile; with it on, a released shared decode decodes again, or
downloads again when its response could not be kept. This happened to
an Image coming back to the tree, and to another Image given the
source, such as a recycled list item.

A source now keeps the pixel size of what it released until it opens
again or changes, a released shared decode keeps its own, and an Image
measures with it meanwhile, as WinUI keeps the image's size. A source
that fails or is cleared still leaves the Image empty. An Image never
added to the tree doesn't open its source, as on WinUI, and a test now
covers it.

6.8 differences:
- Arrange scaled the brush by the surface's image size, which a
  released surface, or an Image with no surface yet, doesn't have: it
  now keeps its last scale until the image is there.
- The SVG path is unchanged, as 6.8 keeps an SVG source's parsed
  document.
- 6.8 has no texture-backed surfaces, so 772c328 isn't needed.
- The size test runs on Skia desktop and the off-tree test on Skia;
  both pass on WinUI on master. The native renderers open their sources
  themselves.

Port of unoplatform#25633 (9f71cb9 and 9fcac22), with the
shared-source Image test of unoplatform#25124's fa4a240, whose helpers its
tests use.

A source that outlives its brushes, such as an icon in a static field
or in the app resources, kept every ImageBrush that ever painted it
alive, and with each one the element it painted. The source held the
brush's subscription and its Invalidated handler strongly. It now
holds both weakly: the brush keeps a lease on its subscription, whose
finalizer ends the subscription once the brush is collected, so the
source can release the pixels it owns; an open in flight keeps the
brushes waiting for it alive, but not one that left the source; and
Invalidated becomes a weak RegisterInvalidated registration.

6.8 differences:
- The open's completion also ends a shared decode's open use (the
  unoplatform#25559 port), so the keep-alive release sits inside that try.
- The native Image's WriteableBitmap handler (Image.cs) uses the weak
  registration too. The native WebAssembly brush keeps its own
  per-element subscription, unchanged.
- The test surface type is SkiaCompositionSurface.

An ImageSource kept its subscribers in a strong list, and the Skia
Image subscribed to the SourceLoaded and OpenFailed events of an
SvgImageSource. ImageBrush did the same with its subscription and with
a handler on ImageSource.Invalidated. All of these were only released
when the consumer's source changed, so a source that outlives its
consumers, such as an icon in a static field or in the application
resources, kept every Image and ImageBrush that ever used it alive,
along with everything they reference.

Hold the subscribers weakly instead: the disposable returned by
Subscribe keeps the callback alive for as long as the consumer holds
it, and an open in progress keeps the current subscribers alive until
it completes, as a SetSourceAsync awaiting it may be referenced by
nothing else. The SVG events and Invalidated are forwarded through
handlers that hold the consumer weakly and unsubscribe once it is gone.
When sources open and when ImageOpened and ImageFailed are raised is
unchanged.

This is a narrow servicing fix: on master, Image subscribing only while
loaded (#25124) fixes this as part of a much larger change. A source
used by a single element still references it as its inheritance
context parent until another element uses it, which is addressed
separately (#25102) and not covered here.

Fixes #25596

With the bitmap cache on, the decode shared by the BitmapImages that
load the same uri and decode size was owned by an LRU of
MaxBitmapImageCacheCount (100) entries. No source released it, and the
LRU kept it whether or not anything displayed it. An entry the LRU
evicted, or a shared load whose requesters were all cancelled, was left
to finalization (unoplatform#25128).

A shared decode now counts its uses: the opens waiting for it, and the
sources whose subscribers draw it or were given it to draw. Once it has
none, it waits on the same pending-release list as the decodes sources
own (1 s and MaxUndisplayedImageBytes, oldest first). When released, its
frames are freed and it leaves the cache, and a source that still holds
it opens again on its next subscriber. It keeps its pixel size, which an
Image showing that source measures with until then, as for the decodes
sources own.

An open hands its use over to its source once the source counts its own
use. Any other way out of the open (cancelled, failed, superseded, a
handler that throws) ends it, so nothing can release the result in
between, and nothing keeps it for good. A load whose requesters were all
cancelled keeps running for later ones, as since unoplatform#25101, and its result
then waits like any other.

The sharing follows WinUI's ImageCache, which leaves the provider's
store once the last BitmapImage using it lets it go (MUX Reference:
ImageProvider::EnsureCacheEntry, ImageProvider::RemoveImageCache). Like
that store, the cache does not own its decodes. An ImageBrush keeps its
subscription for its lifetime, so a source can be collected while it
still counts as a user. Sources are therefore held weakly, and a
collected one is dropped the next time the decode's uses change.

A subscriber that comes back still drawing a shared decode its source
replaced while it was away uses it again until it draws what replaced
it, as unoplatform#25124 lets it take back replaced pixels it owns.

The LRUCache helper had no other user and is removed.
MaxBitmapImageCacheCount no longer bounds anything; the next commit
marks it obsolete.

Shared decodes are kept while something draws them or was given them to
draw: while either of two sharing sources shows one, and for a moved
Image, an Image a re-entrant change skipped, one that comes back while
the replacement downloads, a drawn brush, an Image that left between
delivery and measure, and a collapsed Image. Once nothing does, they are
released on the same list and limit as owned decodes, and opened again
from one new decode.

An open superseded while taking its pixel size, or whose ImageOpened
handler throws, gives up its shared result, as does a shared load whose
requesters were all cancelled, a brush given another ImageSource, and a
source an ImageOpened handler switched away from. A source collected
while subscribed keeps no decode in the cache, alone or shared with a
live one, and does not hide the live one's use.

A released download is decoded again from its encoded bytes, unless the
response was unsuccessful, redirected (desktop), or said no-store,
no-cache or max-age=0. The encoded cache drops the least recently used
image once full, bytes unused past the expiry, and what a lowered bound
or a disabled cache no longer allows. On WebAssembly, where a test
cannot listen, a stand-in for fetch serves the image and counts its
requests.

Two tests from unoplatform#25124 assumed a shared decode is never released: the
within-delay one now waits with a long delay instead of a limit of 0,
and the cache-off one also checks that the shared decode goes, on a
decode size of its own. The failed-source test also checks the release
with the cache on.

Takes Uno's servicing/6.8 from 6951c2c up to 5254ace (42 pull
requests). Conflicts, by area:

IME and TextBox (unoplatform#25984, backport of unoplatform#25804; unoplatform#25952, backport of unoplatform#25619;
unoplatform#25976, backport of unoplatform#25818)
- Takes upstream's composition design (unoplatform#25804): the browser's input is
  the source of truth for the text, compositions included. This drops
  the composition parts of the unoplatform#24502 port (90746b8): its
  TypeScript composition handling, the StartIndex/TextChangePending
  event arguments, the IsReadOnly forwarding to the hidden input, and
  its Given_TextBox.BrowserSoftKeyboard tests.
- Keeps the non-IME browser fixes on top of it, in the form their
  master pull requests have on unoplatform#25804: Enter raised once per press and
  tracked by key code (unoplatform#25174, with Given_TextBox.BrowserEnterKey from
  master in place of the Enter tests that lived in the dropped file),
  the iOS refocus on tap (unoplatform#25185), pastes without text and isIOS from
  BrowserInputHelper.
- Moves the unoplatform#26005 MaxLength fixes onto unoplatform#25804's native input path, as
  master has them: a refused browser edit keeps the TextBox's selection,
  TextBoxView.UpdateTextFromNative reports whether the edit went in, and
  the IME keeps its range on the applied text (master be85699, which
  d226897 had ported onto the unoplatform#24502 IME). Adds that commit's browser
  and platform-applied IME tests.
- TextBox.pointers.skia.cs: upstream's file (unoplatform#25619 iOS touch editing,
  unoplatform#25818, unoplatform#25804), with the unoplatform#25126 port (the hold acts when it starts,
  a touch right-tap keeps the caret) in the form master's unoplatform#25126 branch
  has it on unoplatform#25619, including focusing before the iOS hold timer acts
  and its iOS not-focusable test.

Pointers (unoplatform#25976, backport of unoplatform#25818)
- Tapped and RightTapped are raised once the PointerReleased bubbled
  (unoplatform#25818), with the unoplatform#25732 port's window coordinates (2-argument
  routed event args, RawPosition for ContextRequested), as master's
  unoplatform#25732 branch has them.
- The release wrapper of unoplatform#25818 keeps the unoplatform#25126 port's
  StopContextMenuTimer at the start of the release.

DependencyObject (unoplatform#26142, backport of unoplatform#26123)
- Takes upstream, then the code of unoplatform#25839 (97a2f17), which replaces
  this branch's unoplatform#25102 ports (800247f, be41da6, fd40bf9,
  7546379). DependencyObjectStore.Binder.cs, .alc.cs,
  Application.Alc.cs, ResourceDictionary.alc.cs and their tests now
  match unoplatform#25839; this drops 800247f's own
  SingleParentNonFE_Parent_Removes_Value_Then_Next_Parent_Starts_Clean
  test, which unoplatform#25839 doesn't have.

Imaging (unoplatform#25597, unoplatform#25915, unoplatform#25911, unoplatform#25897)
- Keeps this branch's side: it has the later forms of these fixes
  (unoplatform#25124, unoplatform#25559, unoplatform#25633 and unoplatform#26370 ports), where upstream has the
  6.8-only unoplatform#25597 design and earlier snapshots. Upstream's shared
  download, IgnoreImageCache and failed-load fixes are covered by
  SharedImageDecode. Adds upstream's When_Source_Outlives_Brushes test.

ToolTip (unoplatform#26098, backport of unoplatform#25137 and unoplatform#26096)
- Keeps this branch's unoplatform#25137 port and adds unoplatform#26096 in master's form: the
  service releases only a ToolTip it opened, and leaves one the app
  opened during the show delay to the app. Keeps both sides' tests.

Flyout (unoplatform#26062, backport of unoplatform#26060)
- This branch had the same commits already; keeps the "Keep
  non-resizable flyouts in window" port and its tests.

Also removes a helper pair in Given_AccessibleTextBox that both sides
added.