Signed left shift UB in mp3dec_skip_id3v1 (APEv2 tag size)

[haiyang4]

Similar to the issue in mp3dec_check_vbrtag reported in #140, there's the same pattern in mp3dec_skip_id3v1() at minimp3_ex.h:153:

uint32_t tag_size = (uint32_t)(tag[3] << 24) | (tag[2] << 16) | (tag[1] << 8) | tag[0];

tag[3] is uint8_t, promoted to signed int before shifting. When tag[3] >= 128, tag[3] << 24 overflows signed int — UBSan reports:

minimp3_ex.h:153:47: runtime error: left shift of 250 by 24 places cannot be represented in type 'int'

Found with AFL++ and -fsanitize=undefined.

Casting to uint32_t before shifting fixes it.