Avoid leaving pointers to free'd memory

Fixes potential free'd memory access introduced by
3a94e8ce90c0a4d11c5c5aa8805c167c8a0434e5. I don't think this is actually
possible in the current code; we push/pop before and after rendering a
PDF, so the bottom state should never have a mask.

Still, better to clean this up.
Do not use objects just after deleting them

The error condition in GfxCIDFont::GfxCIDFont references cMapName and
collection, so they should not be deleted yet.
Replace GooVector with new implementation

Reimplemented for because the original was of unclear licensing. The new
GooVector also implements a much larger subset of std::vector's API.
Maintain the height of the stack in Gfx

Introduces a new variable Gfx::stackHeight that maintains up-to-date
information about the current height of the stack.
Add a stack of stateGuards to Gfx

While a stack of states is a good way to maintain graphics contexts, if
the command stream you are interpreting is untrusted, we must place
appropriate guards to be sure that, not only do we not pop past the end
of the stack, but we do not pop past the stack as it was when we began
rendering.

This actually fixes stack check in #24575.
Allow commands to abort the current stream

In many instances, the sensible response (and what acroread does) in
case of an error is abort the PDF stream. To avoid changing the return
value of every function and using C++ exceptions, we communicate via a
commandAborted variable.

This patch, matching acroread's behavior aborts the current stream when
there are too few arguments or we pop too many times. Implementation
note 39 in Appendix H of the PDF reference contradicts the former, but
hand-crafted test PDFs as well as the file in #24575 suggest otherwise.

Unlike all the other attempts, this patch *actually* fixes the PDF in
bug #24575.
fix warnings