gltfio: heap OOB read on malformed skinned .glb — JOINTS_0 index unchecked in computeBoundingBoxSkinned

Loading an untrusted glTF/`.glb` with a skinned mesh can trigger a heap out-of-bounds read. `gltfio` computes a skinned mesh's bounding box by reading each vertex's `JOINTS_0` attribute and using it to index the skin's joint arrays without bounds-checking against `joints_count`.

**Affected code** — `libs/gltfio/src/FilamentInstance.cpp` (`computeBoundingBoxSkinned`, ~L223–232):
```cpp
size_t jointIndex = joints[i][j]; // from JOINTS_0, unchecked
Entity jointEntity = instanceSkin.joints[jointIndex]; // OOB read (4B) if jointIndex >= joints_count
mat4f inverseBindMatrix = assetSkin.inverseBindMatrices[jointIndex]; // OOB read (64B)
```
`instanceSkin.joints` and `assetSkin.inverseBindMatrices` are both sized to `joints_count`; cgltf does not clamp `JOINTS_0` values.

**Impact:** small OOB → adjacent heap bytes are folded into the computed AABB (observable float coordinates); large index → SEGV (crash). Reachable on load for any skinned primitive — `computeBoundingBoxSkinned` is dispatched during bounding-box computation, no special API opt-in.

**Repro:** a `.glb` whose `JOINTS_0` contains an index `>= joints_count`. With an ASan build this yields `AddressSanitizer: heap-buffer-overflow READ of size 4` (small OOB) and SEGV (large index).

**Suggested fix:** bounds-check `jointIndex` against `joints_count` before indexing (one guard covers both arrays). I previously opened PR #10173 with this fix, but it was auto-closed because `libs/gltfio` changes are maintainer-only; filing here as requested by that bot.

Start in libs/gltfio/src/FilamentInstance.cpp at computeBoundingBoxSkinned and inspect how JOINTS_0 values are used with joints_count-sized arrays. Reproduce the malformed skinned .glb under an ASan build, then verify that out-of-range joint indices no longer cause an OOB read or crash.

Written by the indexing model from the issue text.