gzwrite: bound pending input after a non-blocking stall

[thesmartshadow]

This addresses CVE-2026-85091.

A non-blocking gzwrite() can leave more than state->size bytes
pending while strm->next_in still refers to caller-owned input.

gz_vacate() compacts that input into state->in before gzprintf()
uses the buffer again. It currently does so without requiring the
pending input to fit in the first half of the internal buffer.

Do not compact pending input unless it fits in state->size. If the
write is still stalled with more input pending, return Z_BUF_ERROR
from gzprintf() instead of continuing with an invalid buffer layout.

Add a regression test using a full non-blocking pipe, a small
gzbuffer(), a large incompressible gzwrite(), and a following
gzprintf() call.

The test reports a heap-buffer-overflow in gz_vacate() on v1.3.2 with
ASan. It passes with this change, as do the normal test suite and an
ASan/UBSan build.

Fixes #1310.

[madler]

Thanks. Fixed. df84af2