Reject UTF-16 and UTF-32 BOM input while preserving UTF-8 BOM support

[Seddryck]

Problem

With BOM detection enabled, StreamReader can switch away from UTF8Encoding(false, true) when it detects a UTF-16 or UTF-32 BOM.

ReadToEnd() then decodes the stream successfully using that encoding, so non-UTF-8 input is accepted without raising DecoderFallbackException.

This bypasses the intended UTF-8-only validation.

Expected behavior

Reject UTF-16 and UTF-32 BOMs explicitly before decoding, while continuing to accept UTF-8 input with or without a UTF-8 BOM.

Acceptance criteria

• UTF-8 without BOM remains accepted.
• UTF-8 with BOM remains accepted.
• UTF-16 LE/BE BOM input is rejected.
• UTF-32 LE/BE BOM input is rejected.
• Add at least one UTF-16 BOM regression test demonstrating that BOM auto-detection can no longer bypass UTF-8 validation.

[Seddryck]

Reviewed as part of 2.0