Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input

The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb`
workbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound
on crafted input. Both are reachable through the public reader API (`open_workbook`,
`Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no
memory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).

1. **Reachable panic (out-of-bounds slice index).** The directory stream is iterated with
`.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`,
`buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream
whose length is not a multiple of 128 yields a short final chunk, causing a panic
(`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte
mini sectors are a second trigger.

2. **Unbounded allocation / OOM.** The DIFAT loader grows the `difat` vector without bounding
the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte
allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).

A consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic,
or process abort under `panic=abort`) or driven out of memory by a small crafted file.

Fixed in calamine 0.38.0 (commit [b8ec4f0](https://github.com/tafia/calamine/commit/b8ec4f0)); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.