To draw attention to the enabled "private vulnerability reporting" feature.
Because unlike the SECURITY.md file which is prominently shown in a few places
in the GitHub UI, the "private vulnerability reporting" feature can be difficult
to find in case users are not aware that it exists.

Cast input_len to u64 before multiplying by 110, avoiding overflow on
32-bit targets (e.g. wasm32) where `input_len * 110` overflows usize
when input_len > 2^32 / 110 ≈ 39MB.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix handling of invalid match offsets during decompression
* extend decompress tests
* remove ineffective zeroing of memory
Is redundant now due to new `offset == 0` check.
And it looks like previously this zeroing did not work as desired anyway:
It only affected the first byte but did not help for any subsequently copied bytes.
The LZ4 C implementation it is referring to does this differently.

* fuzz decompression with MemorySanitizer
* remove inline(always) to avoid performance regression
inline(always) is a footgun. In combination with the changes in
read_match_offset the performance degrades by 50% in some cases.