Previously we'd just allocate extra space for additional data for the
deferred loading, and then do pointer arithmetic to access that data.
This is cryptic and not type safe.
Instead, use an internal type deriving from `PreviewImage`, and manage
that internally. This ensures type safety, while keeping this as
implementation detail (not visible outside of the preview image API) and
keeping internals easy to understand.
Some code did shallow copies of preview images, making ownership
unclear. That made things a bit tricky, but I've made support for
shallow copies explicit now and noted this in comments.
eefee47a8a