prevent indeterminacy by uninitialized variables

There are two issues where variables may be used unitialized:

* extract_exif_resolution fails to set xres and yres for JPEG images if
  there's no valid resolution unit (mainly affects XPS documents)

* xps_measure_font_glyph uses hadv and vadv unitialized if the glyph id
  isn't valid (i.e. if FT_Get_Advance fails)
correctly bound image mask clippings in bbox device

Same as for fz_bbox_fill_image_mask, fz_bbox_clip_image_mask must
transform the unit rectangle to get the bounding bbox.
better buffer underflow protection for ba15a8cd3238a3a3c098ad8b7d96cb0e405fc26f