Fix security and robustness issues, add release automation

[kpchoi]

Summary

This PR addresses multiple security and robustness issues and adds release
automation:

Bug Fixes

• Prevent signed integer overflow in VLC exp-golomb decoding by using unsigned
  arithmetic with masked shifts (no branch penalty)
• Add buffer overflow protection in bitstream reading by checking read_size
  limit
• Validate TransCoeff range in DC and AC coefficient parsing
• Fix buffer size validation in decoder with s64 casting to prevent overflow

Release Automation

• Add GitHub Actions workflow to automatically generate SHA256SUMS for
  releases
• Add GitHub Actions workflow to verify release tag version matches oapv.h
  version numbers

Issues Resolved

• Issue Heap corruption in read_bitstream #219: Heap buffer overflow in read_bitstream
• Issue integer overflow in dec_vlc_read #220: Signed integer overflow in VLC decoding
• Issue TransCoeff range handling in decoder #180: TransCoeff range validation
• Issue Support for signed source releases #215: Signed source releases support

[tuzm24]

LGTM