Check sidick/quirc fork for fixes relevant to our vendored subset

[sidick]

src/qr/ vendors quirc.h, quirc_internal.h, quirc.c, decode.c,
identify.c, version_db.c from sidick/quirc
(a maintained fork of the original dlbeer/quirc,
tracked here specifically because upstream isn't active — see
THIRDPARTY.md). The fork has had fixes since we last synced,
but it's not clear whether any land in the parts AmiAuth actually exercises.

Note: unlike qrcodegen (pinned to an exact upstream commit, see
THIRDPARTY.md), there's no recorded commit hash or fetch script for our
quirc copy — it looks like a manual snapshot. Worth pinning a commit here
too once this is resolved, so future syncs are a diff against a known point
rather than "compare two working trees."

To check: diff our vendored copy against the fork's current HEAD,
focusing on whether any fix touches the actual call surface AmiAuth uses
(src/qr/qr.c is the only caller):

• quirc_new / quirc_resize / quirc_destroy
• quirc_begin / quirc_end (drives identify.c's geometry detection —
  the float-heavy part QUIRC_FLOAT_TYPE=float exists for, see docs/ or
  the Makefile's QUIRC_SRCS comment)
• quirc_count / quirc_extract
• quirc_decode / quirc_flip (uses version_db.c's tables)

If a relevant fix exists: pull it in, keep the ISC license header intact,
re-run make qr-onhw-smoke (the on-target QR-decode test) to confirm
nothing regressed on real/emulated 68k. If nothing relevant changed: note
that here and close, but still worth pinning a commit for next time.

[sidick]

Resolved by #110 (merged as b31f49b):

• Synced src/qr/{quirc.c,quirc_internal.h,decode.c,identify.c} to sidick/quirc@198897c; quirc.h and version_db.c were unchanged upstream.
• Three relevant fixes landed in the call surface src/qr/qr.c uses: the quirc_extract off-by-one grid-index bounds check, the missing code->size validation in quirc_flip (stack OOB read/write on malformed input), and signed-overflow/UB fixes in quirc_resize/otsu arithmetic and identify.c's perspective-transform math.
• The vendored commit is now pinned in THIRDPARTY.md, matching the qrcodegen convention, so future syncs diff against a known point.
• make test (393 passing, incl. the QR round-trip) and clean m68k/GUI docker builds verified. The qr-onhw-smoke failure observed during testing is pre-existing and unrelated (identical on pre- and post-update quirc) — tracked separately in qr-onhw-smoke fails locally: silent exit after image load, before decode #111.