Add reference element reads

[ero-qt]

Part of #149.

Adds read_reference_array and read_reference_list, which hand back the elements' object addresses, and read_string_object, which reads a string at one of those addresses. read_string is a dereference followed by read_string_object. string[] and List<string> become readable.

Reference elements are pointers at the target's width, so a width claim through read_array compiles at either width and silently answers garbage at the wrong one. These readers own the width. Null elements come back as null addresses at their positions, and only a null collection reference refuses.

Custom-class elements work the same way. The object address plus get_field_offset reads fields directly.

cargo test --all-features runs the suite. The new tests cover reference arrays and lists on both runtimes, lengths past the buffer, nulls kept in place, and string objects at their addresses.

---

Depends on #152.