GHSA-6692-8qqf-79jc: `Read` on uninitialized buffer may cause UB ('tectonic_xdv' crate)

The vulnerability stems from the buffer initialization pattern shown in the commit diff. The original code used Vec::with_capacity() + unsafe set_len() to create an uninitialized buffer, which was then passed to Read::read(). This matches the exact scenario described in the advisory - passing uninitialized buffers to user-provided Read implementations. The fixed commit replaced this with vec![0; BUF_SIZE], proving the vulnerable code was in this specific function. The XdvParser::process method is clearly identified as the location where the unsafe buffer handling occurred before the patch.