avcodec/jpegxl_parser: stop before a TOC that cannot fit in the input

Fixes: QbQGn4p3g48Q
Fixes: AISLE-2026-0150-00842
Fixes: Timeout
Timeout Replicated through UnModified FFmpeg with /usr/bin/time

Found-by: Joshua Rogers <joshua.rogers@aisle.com>

libavcodec/jpegxl_parser.c

@@ -1317,6 +1317,10 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
     else
         toc_count = 2 + num_lf_groups + num_groups * num_passes;
 
+    /* each TOC entry takes at least 12 bits */
+    if ((int64_t)toc_count * 12 > get_bits_left(gb))
+        return AVERROR_BUFFER_TOO_SMALL;
+
     // permuted toc
     if (get_bits1(gb)) {
         JXLEntropyDecoder dec;