feat: add blob take and BlobFile read APIs

[MisterRaindrop]

Builds on #81; the first two commits are that PR.

Adds the row-addressed blob API from #76: lance_dataset_take_blobs (by _rowid) and lance_dataset_take_blobs_by_indices (by row offset) fill a caller array of LanceBlobFile*, NULL for a null value; the handle has size, read, read_up_to, read_range, seek, tell and close. Reads copy into caller buffers and return 0 / -1 with the thread-local error set.

The handle wraps upstream BlobFile only, so it outlives the dataset. Take is all-or-nothing (out untouched on error), read rejects a buffer smaller than the remaining bytes instead of truncating, and an unknown column is an invalid argument rather than LANCE_ERR_INTERNAL. lance.hpp gets an RAII BlobFile and Dataset::take_blobs*() returning std::vector<std::optional<BlobFile>>.

Tests: sixteen test_blob_* cases (both entry points over every storage layout, with and without stable row ids, cursor semantics, bounds and overflow, handles outliving the dataset, NULL and invalid arguments with out untouched) plus the C and C++ smoke programs.

Open: read goes from the cursor to the end like the Rust and Java read(), and seek is not bounds-checked, like upstream. take_blobs_by_addresses and kind / uri accessors are not included.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The opaque LanceBlobFile wrapper closes the C-access gap documented in #76 while preserving upstream random and range reads instead of forcing large payloads into scan batches. Input validation happens before caller output is touched, handle ownership is independent of the dataset, and the multi-fragment coverage exercises inline, packed, dedicated, empty, null, bounds, and cursor behavior through Rust, C, and C++.

This is stacked on #81, whose current head exactly matches this branch’s first two commits; land #81 first, then this PR.