fix(imaging): Let a long-lived source drop the brushes it painted - #25633

WinUI frees the surfaces of an image that left the tree once it has
been off it for 1 s (sc_imageSurfaceWrapperReleaseDelayMilliseconds,
CCoreServices::TrimMemoryOnSurfaceWrappers). PendingImageReleases
keeps what nothing displays for that delay and releases it at the end
of a layout pass, so an element re-parented or recycled meanwhile keeps
its pixels.

Uno decodes images in full unless asked otherwise, so the waiting
images are also bounded, oldest first, by
FeatureConfiguration.Image.MaxUndisplayedImageBytes: 128 MB on
desktop, 64 MB on Android, iOS and tvOS, 32 MB on WebAssembly. The
waits are two queues, ReleaseDelay in the order they end and data
released after the pass, so a check costs what it releases.

An ImageSource kept its decoded data after its last subscriber left.
It now hands the data it owns to PendingImageReleases then, and takes
it back if a subscriber returns in time.

Data it replaced stays while a subscriber still draws it or was given
it, as WinUI keeps the surface while it switches URIs. Each
subscription tracks what it draws apart from what it was given, and a
record per surface counts the holds, the Images that left with it,
which then waits the full delay so they can come back with it, and its
wait. A source that failed or was cleared gives a returning subscriber
an empty image. A notification skips subscriptions disposed meanwhile
and stops once one changes the source, and Dispose opens the source
again for what still shows it.

The Skia Image had no unload handling, so an unloaded Image kept its
subscription, and its pixels, for its own lifetime. It now releases it
when unloaded and subscribes again when loaded, passing what its sprite
still draws, and reports what it draws once measured. It raises
ImageOpened once per source, as WinUI, and shows nothing when its
source fails.

ImageBrush keeps one subscription across UriSource changes, as the
source reopens for it, and lets go of its surface when given another
ImageSource, as a WinUI brush draws its source's surface. Both keep
only the last subscription when a handler changes the source while
they subscribe.

Clicking quickly through large images supersedes opens whose decodes
still land, and their surfaces were left to finalization. A superseded
open now releases what it produced, unless the bitmap cache shares it,
whose load keeps running for its other requesters. An open that app
code supersedes or ends before it returns leaves the source's state
alone.

BitmapImage checks after each size setter, so a superseded open can't
overwrite the replacement's size or raise its events, and ImageOpened
is raised once per source, as WinUI. A RenderTargetBitmap open no
longer runs on the open's token, so a superseded result still reaches
Open, which releases it.

A loopback server that holds a response's body lets a test act while a
download is in flight. Given_BitmapImage had one; it is now a helper
the image release tests use too, accepting off the UI thread so a test
can hold that thread while a response is pending. The download tests
load their Images in a panel, as an unloaded Image no longer opens its
source.

Given_Image_Release observes each surface's release directly or
through a codec wrapper: waits and the limit, replaced pixels, Images
that leave and return, brushes, re-entrant handlers, superseded opens
and events. Tests that need the loopback server or hold the UI thread
run on Skia desktop.

A load that has already completed is published before
TryOpenSourceAsync returns, and its PixelWidth, ImageOpened and
ImageFailed handlers run then. Open marked itself in flight only once
the loader returned, so a handler that unloaded the last Image found
neither data nor an open, nothing was queued, and the decode that
followed stayed outside both the delay and the limit.

Open now marks itself in flight first, and a decode that completes
while nothing subscribes and nothing waits starts its own wait.

A source kept its failure after its last subscriber left, and an Image
that came back alone took the path that opens a source nothing
subscribes to: it retried the unchanged source, raising ImageFailed
again on BitmapImage and Image, where one that attached while another
subscriber remained got nothing.

As on WinUI, where a source that needs no reload is not reloaded for
an element that attaches to it, a failure now stays until the source
changes. An Image still drawing an earlier image gets an empty one, as
when other subscribers remain.

An icon held in a static field or an app resource outlives the Images
that show it. On master an Image subscribes to its source until its
Source changes, and the source keeps that callback, which captures the
Image, in a strong list: every Image that ever showed the icon stays
alive, with everything it references.

An Image now subscribes only while it is loaded, so the source lets go
of it once it leaves the tree. Cover a bitmap, a cached URI and an SVG
source, each shared by two Images, as icons are: a source with a single
owner still keeps it as its inheritance context parent, which this does
not change.

Refs unoplatform#25596

An auto-sized Image showing a source that released its pixels, because
nothing displayed them for the release delay, measured a surface with
no size and laid out at 0×0 until the source decoded them again. With
the bitmap cache off, a URI downloads again meanwhile, so the layout
around the Image collapsed and then grew back. This happened to an
Image coming back to the tree, and to another Image given the source,
such as a recycled list item.

A source now keeps the pixel size of what it released until it opens
again or changes, and an Image measures with it meanwhile, as WinUI
keeps the image's size. A source that fails or is cleared still leaves
the Image empty.

An Image now subscribes to its source only while it is loaded, so one
that was never added to the tree no longer opens its source or raises
ImageOpened, as on WinUI. Cover it, and that the source opens once the
Image is loaded.

Releasing a surface built around a texture would dispose the texture,
which is its content: nothing could decode it again. No image source
creates such a surface today, but one that did would have shown
nothing once its Images came back. A source now neither counts nor
releases one, and the surface itself ignores a release.

Two brushes on two Borders share a stream bitmap, an SVG or a cached
UriSource, as icons are. Once the Borders left the tree, the brushes and
the Borders are collected, and a stream source releases its decoded
pixels once the brushes are gone. A cached URI's pixels stay with the
cache, as before.

Guard the weak references the source now holds:
- a brush still painted keeps getting its source's images and change
  notifications across collections;
- brushes only an app waits on still raise ImageOpened when their
  source finishes downloading;
- a brush whose ImageOpened handler switched it to another source is
  told when that source changes;
- a brush whose ImageOpened handler threw while it subscribed doesn't
  keep its source's pixels once it is collected.