Add decompression bomb check for `Image.new()`

... in the same way as `Image.open()`.

Something like this for #771?