byte_array_grow() assigned the result of realloc() directly to
ba->data and increased the capacity even if realloc() failed, so the
following memcpy() in byte_array_append() wrote to NULL + len.

On failure, free the old buffer and leave the byte array in a failed
state (data == NULL), which byte_array_append() already ignores. The
callers check for that state:

- the writers (bin, xml, json, openstep and the text output formats)
  return PLIST_ERR_NO_MEM instead of handing out a NULL/truncated buffer
- node_to_xml() base64-encodes <data> directly into the grown buffer,
  so it must bail out there (only guarded by assert() before)
- the OpenStep parser returns PLIST_ERR_NO_MEM for <hex data> instead of
  silently returning truncated data

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Avoid undefined behavior when serializing malformed PLIST_DATE values
containing NaN, infinity, or values outside the Time64_T range. Add a
shared helper for checked date conversion and use it across writer paths.

Improve robustness and memory safety in node_to_string() and dtostr():

- add missing NULL and allocation checks
- fix snprintf() error handling and signed/unsigned conversions
- replace sprintf() with snprintf()
- fix base64 buffer sizing
- switch string offset tracking to size_t
- improve malformed data handling for strings and data blobs

Thanks to @unbengable12 for reporting. Addresses #288, #289, #290, #291, and #292.

Thanks to @LkkkLxy for pointing out the issue.

This commit introduces constants for the different plist formats,
and adds 3 new human-readable output-only formats:
- PLIST_FORMAT_PRINT: the default human-readable format
- PLIST_FORMAT_LIMD: "libimobiledevice" format (used in ideviceinfo)
- PLIST_FORMAT_PLUTIL: plutil-style format

Also, a new set of write functions has been added:
- plist_write_to_string
- plist_write_to_stream
- plist_write_to_file

Plus a simple "dump" function:
- plist_print

See documentation for details.