`Image` fields should not be public

## What problem does this solve or what need does it fill?

The `Image` type has quite a few complex invariants to uphold, around data layout and byte intepretation.

As a result, it has several nice constructors, which do the math for you.

However, the fields are fully public, and can be constructed in or modified to be invalid with no protections.

## What solution would you like?

All fields should be private, and getters and setters should be added, which should generally return error types.

## What alternative(s) have you considered?

Leave it alone: maybe the rendering people have good reasons to do cursed transmute-style type punning?

## Additional context

We might also want to add non-panicking variants to the various panicking methods at the same time.