Fix integer overflow in Gradient::populate()

A signed integer overflow vulnerability existed in `src/lottie/lottiemodel.cpp`
where the `colorPoints` value from untrusted JSON input (`g.p` field) could be
set to values >= 0x40000000, causing `colorPoints * 4` to overflow to 0.
This bypassed the bounds check and led to a heap buffer over-read
during gradient rendering.