A `trailer` marker inside an unreferenced stream followed by `(` and more
than 4 KiB of text made the lexer stop at the window's end, so a later
`/Encrypt` name anywhere in the file refused a plain file. The unbounded
scan read a string there and opened it. The past-the-window fallback now
applies only when no object starts in the window or the first one opens
a dictionary (`<<`, including one split by the window's end).
Regression test with `trailer(` and `trailer[` in a stream and a later
Encrypt name.
The pre-scan window could end inside a trailer key, so a decoy like
`/Encrypted` cut right after `/Encrypt` was taken for the Encrypt key
and an unencrypted file was refused. A window that ends mid-token now
ends before that token instead, and the past-the-window fallback reads
the name whole (a real `/Encrypt` cut as `/Encryp|t` is still refused).
Tests for that boundary, for a trailer with a long /ID, and for `#`
without two hex digits staying as written in a name.
The fallback searched for the literal bytes `/Encrypt`, so a long trailer
with the key written as `/Encr#79pt` (or any other #-escaped spelling) got
past it. It now finds the last name token that decodes to `Encrypt`, with
the lexer's own name decoding, and checks whether that token ends past the
window. It is still one linear pass per file. Longer names that only start
with `Encrypt` (`/Encrypted`) no longer count.
The pre-scan lexed one object after every `trailer` marker over the rest of
the file, so an unterminated string or dictionary after each of many markers
made opening a crafted PDF quadratic. Each lex now gets a 4 KiB window; when
it runs out, the file is refused if `/Encrypt` appears past the window (one
search per file), so long trailers can't hide the key.
becauseno7