Summary:
- replace the `image-size` dependency with an in-tree parser for the image formats Metro supports
- dispatch by the declared asset type rather than running unrelated format detectors
- preserve CgBI PNG, SVG units/viewBox, TIFF endianness, WebP variants, and KTX1/KTX2 support
- reuse the first asset buffer already read for hashing
- reject truncated, mismatched, non-positive, and non-advancing malformed inputs

This removes `image-size` and its `queue` dependency without introducing a new third-party package. The parser is derived from the MIT-licensed `image-size` format support, with its notice retained inline and bounds/forward-progress checks added throughout.

Refs #1762
Refs #1800

Pull Request resolved: #1860

Test Plan:
- `yarn flow check`
- `yarn typecheck-ts`
- `yarn lint`
- `yarn build`
- `node node_modules/jest/bin/jest.js packages/metro/src/lib/__tests__/imageSize-test.js packages/metro/src/__tests__/Assets-test.js --runInBand --no-watchman`
- full Jest run: 141 suites passed; the two Watchman integration suites failed because the local environment cannot chmod the shared Watchman state directory
- checked all applicable fixtures from the upstream `image-size` corpus
- exercised 100,000 randomized malformed buffers across all parsers

Changelog: [Fix] Remove the image-size dependency and parse supported image dimensions within Metro.

Reviewed By: huntie

Differential Revision: D116437966

Pulled By: javache

fbshipit-source-id: 9f88b14668ae863b22a4aaf91b1298967c7f07c1

Summary:
`flow-api-translator` assumes that a function without an explicit return type
annotation returns `void`. That isn't true of `async` functions, which always
return a `Promise`, so our generated `.d.ts` declares seven async functions as
returning `void` - including the public `Server#end()`, `Watcher#watch()`,
`Watcher#close()` and `DependencyGraph#end()`. TypeScript consumers awaiting
those get `await-thenable` from typescript-eslint, or quietly don't await at
all.

I've fixed the translator upstream in
facebook/flow#9486, but 0.84.x pins
`flow-api-translator` 0.35.0 and I'd rather not bump the toolchain on a release
branch, so this annotates the return types at source instead. It's a no-op for
Flow, which already infers `Promise<void>` in every case here, and it's what we
want in the source regardless. `main` will pick the translator fix up with the
next version bump, after which these annotations are still correct, just no
longer load-bearing.

To find the full set I translated every file the generator covers with 0.35.0
patched and unpatched and diffed the output - these seven declarations, across
five files, are all of them on this branch.

Changelog:
```
 - **[Fix]**: Types: async methods including `Server#end`, `Watcher#watch`/`#close` and `DependencyGraph#end` are declared as returning `Promise<void>` rather than `void`
```

Test plan:
```
yarn run build-ts-defs   # updates exactly the five .d.ts files, no other churn
yarn typecheck           # No errors!
yarn typecheck-ts
yarn jest packages/metro/src/Server/__tests__/Server-test.js packages/metro-file-map/src/__tests__ packages/metro-file-map/src/watchers/__tests__
```

Pick #1885, type-only non-breaking changes.

Test plan:
`yarn run flow`
`yarn run build-ts-defs` -> no changes