Add unified addon image assets

Implement a unified image URI system for Lua UI packages and client-owned XML. Intended outcome: - Replace every `bitmap_id` use with `image="gfx://…"`; do not retain a compatibility path. - Let XML and Lua reference package-local images, declared asset libraries and supported image-bearing RDB resources through the same resolver. - Allow pure asset-library packages with explicit dependencies so multi-package UI replacements can share decoded images. - Keep image decoding bounded, read-only and package-isolated, with shared native caching where safe. Initial image sources: - `gfx://<installed GUI graphic>` - `package://<relative image path>` - `library://<package-id>/<relative image path>` - `rdb://<image-kind>/<resource-id>` Constraints: - Images only; model rendering remains future work. - No arbitrary filesystem access, symlinks, traversal or cross-package discovery. - Preserve Native AOT compatibility and existing GUI tinting/sampling behavior. - Keep `gfxid_*` button-state skin attributes outside this migration. Verified outcome: - All client-owned `bitmap_id` uses and the `ui.graphic` export were removed in favor of `image="gfx://…"` and `ui.image`. - Package PNG/JPEG/WebP, explicit pure asset libraries and named RDB image kinds share one bounded URI resolver and native bitmap cache. - Package and RDB decoding runs outside the UI thread; completed images apply during the normal UI update. - Package roots, relative paths, symlinks, encoded size, dimensions, pixel count, cache count and decoded memory are bounded. - Full client and graphics-engine suites pass, along with the native Lua sanitizer/generator and Native AOT suite. Published documentation: - `docs/lua-api/addons.md` is included in build and publish output and linked from the generated Lua API index. Pull request: #2971 https://git.project-rk.com/prk/engines/pulls/2971