perf(scanner): bound the tag truncation trim to a partial rune

The trim loop dropped every trailing byte that failed to decode, so a value ending
in a long run of invalid bytes was walked one byte at a time: a 1 MiB lyrics tag
measured 2.58ms against 45ns for a normal cut. A partial rune is at most 3 trailing
bytes, so the loop is capped there, which also stops it consuming a pre-existing
invalid run.

model/metadata/metadata.go

@@ -367,9 +367,9 @@ func sanitize(filePath string, tagName model.TagName, tag model.TagConf, value s
 	if len(value) > maxLength {
 		log.Trace("Truncated tag value", "tag", tagName, "value", value, "length", len(value), "maxLength", maxLength)
 		value = value[:maxLength]
-		// Drop the trailing partial rune the cut may have left behind. Only trailing
-		// invalid bytes are removed, so pre-existing bad bytes elsewhere are preserved.
-		for len(value) > 0 {
+		// Drop the partial rune the cut may have left: at most 3 trailing bytes,
+		// so a pre-existing invalid run elsewhere is never consumed.
+		for range 3 {
 			if r, size := utf8.DecodeLastRuneInString(value); r != utf8.RuneError || size > 1 {
 				break
 			}