Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input

Summary

The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb` workbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound on crafted input. Both are reachable through the public reader API (`open_workbook`, `Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no memory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).

1. **Reachable panic (out-of-bounds slice index).** The directory stream is iterated with `.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`, `buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream whose length is not a multiple of 128 yields a short final chunk, causing a panic (`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte mini sectors are a second trigger.

2. **Unbounded allocation / OOM.** The DIFAT loader grows the `difat` vector without bounding the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).

A consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic, or process abort under `panic=abort`) or driven out of memory by a small crafted file.

Fixed in calamine 0.38.0 (commit [b8ec4f0](https://github.com/tafia/calamine/commit/b8ec4f0)); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.