fix error handling bugs in reader.WriteTo

- r.err is checked before r.WriteTo begins writing. This avoids writing
  corrupt data to the io.Writer.

- r.err is set when decoding errors occur in r.WriteTo. A
  bufferFallbackWriter type is introduced to let r.WriteTo distinguish
  decoding errors vs write errors and allow reading to safely resume
  after a write error occurs.
inline bufferFallbackReader construction