Some runtime errors are not handled properly

### What happened?

There seem to be cases where certain functions that are called in the tile loading process cause a `RuntimeError`, and this error is not handled properly.

For example:

- https://community.cesium.com/t/handle-runtime-errors-when-loading-tilesets/42886
- https://github.com/CesiumGS/cesium/issues/12872

In both of these cases, the `RuntimeError` originated from the `Model.update` function that is called during the tile update. There _might_ be other places where errors leak to the user, but this seems to be one that has already been identified by now.

I think that when the `Model.update` throws, it should be handled accordingly, and end up as a `tileFailed` event. It might be easy to do this by wrapping some `try...catch` around the `Model.update` call and translating the error into a `tileFailed`.

### Reproduction steps

See the linked forum thread and issue report

### Sandcastle example

N/A

### Environment

Browser: All
CesiumJS Version: 133 and earlier (probably since the "Model refactoring"...?)
Operating System: All

Start by tracing the tile update flow to the Model.update call mentioned in the issue, then review the linked forum thread and issue report for the failing cases. Determine how a RuntimeError from Model.update should become a tileFailed event, and verify that the identified error no longer leaks to the user.

Written by the indexing model from the issue text.