TurboJPEG: Expose/extend hidden "max pixels" param

TJPARAM_MAXPIXELS was previously hidden and used only for fuzz testing,
but it is potentially useful for calling applications as well,
particularly if they want to guard against excessive memory consumption
by the tj3LoadImage*() functions.  The parameter has also been extended
to decompression and lossless transformation functions/methods, mainly
as a convenience.  (It was already possible for calling applications to
impose their own JPEG image size limits by reading the JPEG header prior
to decompressing or transforming the image.)

turbojpeg.h

@@ -429,9 +429,6 @@ enum TJCS {
  * Parameters
  */
 enum TJPARAM {
-#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-  TJPARAM_MAXPIXELS = -1,
-#endif
   /**
    * Error handling behavior
    *
@@ -763,7 +760,21 @@ enum TJPARAM {
    * decompression, optimized baseline entropy coding, lossless JPEG
    * compression, and lossless transformation *[default: `0` (no limit)]*
    */
-  TJPARAM_MAXMEMORY
+  TJPARAM_MAXMEMORY,
+  /**
+   * Image size limit [decompression, lossless transformation, packed-pixel
+   * image loading]
+   *
+   * Setting this parameter will cause the decompression, transform, and image
+   * loading functions to return an error if the number of pixels in the source
+   * image exceeds the specified limit.  This allows security-critical
+   * applications to guard against excessive memory consumption.
+   *
+   * **Value**
+   * - maximum number of pixels that the decompression, transform, and image
+   * loading functions will process *[default: `0` (no limit)]*
+   */
+  TJPARAM_MAXPIXELS
 };