Tree::from_data Decompression Bomb

There is a decompression bomb causing memory exhaustion and an OOM kill, denying service to any application that passes attacker-controlled SVG bytes to usvg::Tree::fromdata. The svgz feature is enabled by default, and SVG upload or conversion endpoints that use usvg are typically reachable befor...