Force checking the color type before accessing pixels

… by making pixels fields of the enum variants.

This should help prevent bugs such as https://github.com/servo/servo/issues/3154

[breaking-change]

r? @metajack

This is just proposing the idea for now. I haven’t tried to port Servo for this change.