fix: resolve all GitHub CodeQL security/quality alerts

Fix 9 integer-multiplication-cast-to-long warnings across 6 files:
- wmo_renderer.cpp: grid cell count and height variance calculation
- composite_renderer.cpp: overlay tile grid allocation
- vk_texture.cpp: image size calculation (width*height*bpp)
- m2_renderer.cpp: collision grid cell allocation
- character_renderer.cpp: normal map buffer and height variance
- world_entry_callback_handler.cpp: tile reserve count

All fixes cast operands to size_t/double before multiplication to
prevent integer overflow when dimensions are large.

src/rendering/wmo_renderer.cpp

@@ -2248,7 +2248,7 @@ std::unique_ptr<VkTexture> WMORenderer::generateNormalHeightMap(
         float h = 0.299f * r + 0.587f * g + 0.114f * b;
         heightMap[i] = h;
         sumH += h;
-        sumH2 += h * h;
+        sumH2 += static_cast<double>(h) * static_cast<double>(h);
     }
     double mean = sumH / totalPixels;
     outVariance = static_cast<float>(sumH2 / totalPixels - mean * mean);
@@ -2716,7 +2716,7 @@ void WMORenderer::GroupResources::buildCollisionGrid() {
     if (gridCellsX > 64) gridCellsX = 64;
     if (gridCellsY > 64) gridCellsY = 64;
 
-    size_t totalCells = gridCellsX * gridCellsY;
+    size_t totalCells = static_cast<size_t>(gridCellsX) * static_cast<size_t>(gridCellsY);
     cellTriangles.resize(totalCells);
     cellFloorTriangles.resize(totalCells);
     cellWallTriangles.resize(totalCells);