Keep WebP, AVIF and JPEG XL encodes at the limits under 40 seconds (closes #272)

WebP is saved at effort 2 and JPEG XL at effort 4, and an AVIF output of
more than 16,777,216 pixels is refused with 400 before anything is
decoded, as AVIF is already at the lowest effort govips can set. With one
libvips thread, 8192x8192 random pixels with an alpha channel take up to
about 23 seconds as WebP and 27 as JPEG XL, and 4096x4096 as AVIF about
25. Resizing with fit=cover already decodes the input, so the output's
dimensions are now worked out before resizing, in outputDimensions.
Reading the input moves into readInput to keep Process within the
linter's limits.

Model: opus-5-5

README.md

@@ -294,6 +294,12 @@ either side may be; so is a size with `fit=outside`, which scales the image to
 cover the size and so past it on one side, when that side would come out
 above 8192.
 
+An AVIF image of more than 16,777,216 pixels, the number 4096x4096 and 8192x2048
+have, is refused with 400 before anything is decoded, as its encode could take
+more than 40 seconds (see below). That includes `orig` of an AVIF source, and
+`auto` when it chooses AVIF, so a client whose `Accept` names `image/avif` but
+not `image/jxl` is refused such a size.
+
 The source image may be JPEG, PNG, GIF, WebP, AVIF or JPEG XL. The upstream's
 `Content-Type` must name its format, and the image's first bytes must match it.
 An upstream answering with any other `Content-Type`, SVG included, is refused
@@ -343,14 +349,17 @@ transcode that stops this way is answered 503 with the error
 ended. govips gives pixa no way to stop libvips once an encode has begun, so an
 encode keeps its slot until it finishes, which can be after
 `downstream_timeout`. The limit of 8192 on each side of the source and of the
-output bounds how long that takes. With one libvips thread, as pixad runs it,
-encoding 8192x8192 random pixels takes up to about 1 second as JPEG, 15 as PNG,
-16 as GIF, 63 as WebP, 110 as AVIF and 96 as JPEG XL, the slowest of 8 or 16
-bits per sample, with or without an alpha channel. WebP, AVIF and JPEG XL are
-that slow only with an alpha channel: 8-bit RGB takes about 44, 53 and 28
-seconds. Decoding such a source adds up to about 11 seconds. A WebP, AVIF or
-JPEG XL encode can therefore hold its slot past the default `downstream_timeout`
-of 60 seconds.
+output, and for AVIF the limit of 16,777,216 pixels, bound how long that takes.
+With one libvips thread, as pixad runs it, encoding 8192x8192 random pixels
+takes up to about 1 second as JPEG, 15 as PNG and 16 as GIF, the slowest of 8 or
+16 bits per sample, with or without an alpha channel. The WebP and JPEG XL
+encoders run below libvips' default effort, and AVIF at the lowest effort govips
+can set, so that no encode takes more than 40 seconds of the default
+`downstream_timeout` of 60: at quality 85 or 100 and 8 or 16 bits per sample,
+8192x8192 random pixels with an alpha channel take up to about 23 seconds as
+WebP and 27 as JPEG XL, and 4096x4096 or 8192x2048 up to about 25 as AVIF, which
+would take about 99 at 8192x8192. Without an alpha channel they take up to about
+16, 13 and 15 seconds. Decoding such a source adds up to about 11 seconds.
 
 The login form (`POST /`) is limited to 5 attempts per minute per client
 address, counting an IPv6 client by its /64; an attempt over the limit is
@@ -402,7 +411,8 @@ nor change what it asks for.
    sent with an empty format, or none, also makes a JPEG XL URL. Width and
    height both empty or `0` keep the original size; if only one of them is empty
    or `0`, that side is scaled to keep the image's proportions. A URL whose
-   scaled side would come out above 8192 answers 400.
+   scaled side would come out above 8192 answers 400, and so does an AVIF URL of
+   more than 16,777,216 pixels (see Routes).
 3. The page shows the URL, `https://<host>/v1/e/<token>/img.<format>`, and when
    it expires. `<host>` is the host the page was opened on, and the URL starts
    with `http` instead while `debug` is on. The name after the token is ignored