[php-src] Issue #20631: Integer underflow in exif HEIF parsing when pos.size < 2

Issue: https://github.com/php/php-src/issues/20631
Author: Oblivionsage

### Description

### Description

When parsing HEIF/HEIC files, if the iloc box contains an extent_length value less than 2, the subtraction `pos.size - 2` causes an unsigned integer underflow.

### Location

`ext/exif/exif.c` line 4424 in `exif_scan_HEIF_header()`
 
### Reproducer

```bash
# patch a valid HEIC file to set extent_length = 1
php -d memory_limit=128M -r "exif_read_data('malicious.heic');"
 ```
 
Result:
```
Fatal error: Allowed memory size exhausted (tried to allocate 4294967295 bytes)
 ```

### Fix

PR #20630 - change `if ((pos.size) &&` to `if ((pos.size >= 2) &&`



### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: Dec 2 2025 10:49:47) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
```

### Operating System

_No response_