Stripped HTTP TIFF reads ignore window and caller max_pixels

[brendancol]

The stripped branch of _fetch_decode_cog_http_tiles in xrspatial/geotiff/_reader.py (around line 2003) calls source.read_all() and then slices the decoded array. Two issues:

1. A windowed HTTP read of a stripped multi-billion-pixel COG still downloads the whole raster. The tiled branch a few lines below explicitly promises otherwise: "A windowed HTTP read of a multi-billion-pixel COG only allocates the window." The stripped path silently violates that.

2. The caller's max_pixels is dropped. _read_strips runs with its default MAX_PIXELS_DEFAULT (1 billion), so a 50x50 window read with max_pixels=2500 against a 100k x 100k stripped image raises PixelSafetyLimitError if the file declares over a billion pixels, and gets no safety check otherwise. Neither matches the tiled branch behaviour from Apply tile byte cap to local files + SSRF hardening on HTTP geotiff reads #1664 / VRT source reads with small max_pixels reject normal-tile sources #1823.

Fix: for stripped HTTP files with a non-None window, fetch only the byte ranges of strips intersecting [r0:r1] via read_ranges_coalesced (same as the tiled path), decode them, and place the result into a windowed output. Apply max_pixels to the windowed (r1-r0)*(c1-c0)*samples allocation, not the full image. When window is None, keep the full read but pass max_pixels into _read_strips so the dimension check honours the caller's cap.

Related: #1664, #1823.