zstd RLE blocks can claim 2 MB each: clamp to 128 KB when bounding output

A zstd block header has a 21-bit Block_Size, and the reference decoder (1.5.x) will expand an RLE block of up to 2^21-1 bytes from one input byte, even though RFC 8878 caps blocks at Block_Maximum_Size (min(window, 128 KB)). If you bound a frame's decompressed size by walking its block headers (so you don't trust Frame_Content_Size), adding each RLE block's stated size lets about 510 bytes legitimately decode to 250 MB. Refuse raw/RLE blocks over 128 KB: no frame from real libzstd has one (checked 483 frames across levels -5..19, checksum, content-size and windowLog settings). Separately, the lenient decoder can expand a mutated compressed block slightly past 128 KB, so a 128 KB-per-compressed-block bound refuses a few corrupt frames zstd would accept. That's fine for safety.