test(save): pin exact FPDF_SaveAsCopy flag values

[billdenney]

Stricter counterpart to the "honours ... flags" test in test-mut-save.R, which only asserts a save flag is accepted without error and therefore cannot detect a wrong flag value. The two value-pinning tests here pass today and lock in the chromium/7857 bitmask (FPDF_REMOVE_SECURITY = 4, not the old 3; FPDF_SUBSET_NEW_FONTS = 8). They would have caught the silent no-op that existed while the package was pinned to chromium/7202, where those flags were introduced (commit 41f348e) with 7857 values that did not match the 7202 binary. See dev/pdfium-7857-api-delta.md §C-3.

The third test is skipped pending future work: it pins the behaviour of remove_security (the saved copy must carry no /Encrypt dict) and needs an encrypted.pdf fixture. To enable it: add an owner-password fixture to tools/build-fixtures.R + inst/extdata/fixtures/, then delete the skip().

What changed

Why

Test coverage

• Added or updated tests for every behavioural change.
• R coverage remains 100% (verified locally with covr::package_coverage()).
• If touching src/, the change runs cleanly under AddressSanitizer (.github/workflows/cpp-asan.yaml) and valgrind (.github/workflows/valgrind.yaml).

API stability

• No exported symbol was renamed or removed without a deprecation cycle.
• If an exported function signature changed, an ADR was added or amended.

Decision records

• Linked an existing ADR if one applies.
• Added a new ADR if this PR locks in a material architectural choice.

Checklist

• pre-commit run --all-files passes locally.
• R CMD check --as-cran is clean (0 errors / 0 warnings).
• Documentation regenerated with devtools::document().
• NEWS.md updated under "(development version)".

[billdenney]

Incorporated into #43