Don't let convert_av_frame_to_frame_output() take ownership of the AVFrame - #1595

convert_av_frame_to_frame_output() took a non-const UniqueAVFrame&, which
let implementations steal the caller's frame. Both CUDA interfaces did:
BetaCudaDeviceInterface moved out of it, and CudaDeviceInterface reassigned
it with the result of maybe_convert_av_frame_to_nv12_or_rgb24().

That was invisible under SingleStreamDecoder, whose frame is a loop local
that dies right after conversion. It is not invisible under the
building-block ops, where the frame is owned by a handle that outlives the
call: the frame ends up freed twice, corrupting the heap.

Take the frame by const reference all the way down the conversion path, so
a callee physically cannot move from it or reset it. Where an
implementation needs a different frame, it now owns that one separately and
binds a const reference to whichever of the two applies -- the idiom
convert_audio_av_frame_to_frame_output() already used.

maybe_convert_av_frame_to_nv12_or_rgb24() returns a null frame to mean "no
conversion needed" instead of handing back the input.