Add VNC remote cursor shape sync

Implements RFB's Cursor pseudo-encoding (RFC 6143 SS7.8.2, type -239):
a FramebufferUpdate rectangle carrying a cursor shape instead of
screen content (x/y are the hotspot, not position; width/height are
the cursor image size), decoded into an ARGB32 QImage using the
rectangle's RGB pixel data plus its opacity bitmask, then never
painted into the framebuffer. A 0x0 rectangle means "hide the
cursor" per spec.

VncDisplayWidget gains RdpDisplayWidget's setCursorImage/Hidden/
Default() + applyCursor() shape, reusing its own renderRect()/
effectiveRemoteSize() so cursor scaling works correctly in both the
scale-to-fit and actual-size display modes with no special-casing.
VNC never emits cursorReset() (RFB's Cursor pseudo-encoding has no
"reset to system default" signal, unlike RDP's SetDefault callback) --
setCursorDefault() exists for symmetry but is unused today.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/vnc_session_backend.h

@@ -21,8 +21,9 @@ class QTcpSocket;
 // Scope (see plan / issue #3 for the full rationale): standard VNC
 // Authentication (security type 2) and no-auth (type 1) only -- not
 // Apple's Screen Sharing scheme (type 30). Raw + CopyRect encodings only.
-// No dynamic resize, no remote cursor shape sync. Clipboard sync (Latin-1
-// only, per RFB's ServerCutText/ClientCutText) is supported.
+// No dynamic resize. Clipboard sync (Latin-1 only, per RFB's
+// ServerCutText/ClientCutText) and remote cursor shape sync (the Cursor
+// pseudo-encoding) are supported.
 class VncSessionBackend : public SessionBackend
 {
     Q_OBJECT
@@ -81,6 +82,7 @@ private:
         WaitingRectangleHeader,
         WaitingRawPixelData,
         WaitingCopyRectSource,
+        WaitingCursorPixelData,
         WaitingSetColourMapHeader,
         WaitingSetColourMapData,
         WaitingServerCutTextHeader,