operators: guard unpooling indirection buffer size against overflow

[destro4evr-rgb]

xnn_reshape_unpooling2d_nhwc_x32 computed the indirection buffer size as a raw four-factor product with no overflow guard:

const size_t pooling_size = pooling_height * pooling_width;
// ...
const size_t indirection_buffer_size =
    sizeof(void*) * (batch_size * input_height * input_width * pooling_size);

On 32-bit targets (WebAssembly, ARM32) where size_t is 32 bits and sizeof(void*) = 4, the product overflows when its true value exceeds 2²⁸. The wrapped result causes xnn_reallocate_memory to return an undersized allocation; xnn_indirection_init_unpool2d then writes the full intended extent of pointer entries out of bounds - a heap out-of-bounds write.

This fix replaces the raw product with a xnn_safe_mul chain that returns xnn_status_out_of_memory on overflow, consistent with the pattern used in average-pooling-nhwc.c and argmax-pooling-nhwc.c.