CVE-2026-27809: psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

A security review of the psd_tools.compression module (conducted against the fix/invalid-rle-compression branch, commits 7490ffa–2a006f5) identified the following pre-existing issues. The two findings introduced and fixed by those commits (Cython buffer overflow, IndexError on lone repeat header) are excluded from this report.