fix: resolve all GitHub CodeQL security/quality alerts

Fix 9 integer-multiplication-cast-to-long warnings across 6 files:
- wmo_renderer.cpp: grid cell count and height variance calculation
- composite_renderer.cpp: overlay tile grid allocation
- vk_texture.cpp: image size calculation (width*height*bpp)
- m2_renderer.cpp: collision grid cell allocation
- character_renderer.cpp: normal map buffer and height variance
- world_entry_callback_handler.cpp: tile reserve count

All fixes cast operands to size_t/double before multiplication to
prevent integer overflow when dimensions are large.

src/rendering/vk_texture.cpp

@@ -49,7 +49,7 @@ bool VkTexture::upload(VkContext& ctx, const uint8_t* pixels, uint32_t width, ui
     else if (format == VK_FORMAT_R8G8_UNORM) bpp = 2;
     else if (format == VK_FORMAT_R8G8B8_UNORM) bpp = 3;
 
-    VkDeviceSize imageSize = width * height * bpp;
+    VkDeviceSize imageSize = static_cast<VkDeviceSize>(width) * static_cast<VkDeviceSize>(height) * bpp;
 
     // Create staging buffer
     AllocatedBuffer staging = createBuffer(ctx.getAllocator(), imageSize,