Add dictionary reads

[ero-qt]

Depends on #148.
Part of #149.

Adds get_dictionary_offsets and read_dictionary to both backends' Module, the same resolve-once-then-read shape as lists.

• Resolution starts at the live dictionary object: its class comes off its own header, the corlib field names say the shape (both naming generations work), and the entries field's type answers the entry class. On mono that type's data is the entry class directly; on IL2CPP the array's element is a generic instance and the instantiation's cached class answers. Entry stride is the entry class's own instance size minus the boxed object header, and the four entry members get bounds-checked before anything is trusted. A target still starting up misses instead of resolving garbage.
• read_dictionary returns exactly the live pairs: freed entries are recognized by their marks and skipped, and the live tally has to balance against the counts or the read fails rather than answering wrong pairs. The buffer bounds live pairs, never the counted entries or the backing capacity. Key and value types are caller claims like read_array's, refused when a claim outgrows the room its member has inside one entry.
• The offsets tables grow what this reads (instance sizes, the type words, the field type slot, IL2CPP's cached class), measured per build; the fallback tables carry values only where two measured builds agree, which leaves the 2022.2-and-later IL2CPP fallback without a cached class on purpose, since the measured builds inside that stretch disagree. Known builds carry their own.
• IL2CPP's Module also gains get_pointer_size, matching mono's, which is what reference-width claims need.