Fix use-after-free crash risk in screenshot haptic feedback

Found by an automated audit pass. UIImageWriteToSavedPhotosAlbum was
passed feedback via a plain __bridge cast, which doesn't transfer
ownership -- the local UINotificationFeedbackGenerator had nothing
else retaining it, so ARC could deallocate it before the async save
actually completed. screenshot:didFinishSavingWithError:contextInfo:
would then read a dangling pointer out of contextInfo on every real
screenshot. Switched to __bridge_retained on the write side and
__bridge_transfer on the completion side so ownership is actually
held across the async gap and released exactly once.

Author: meticulosity-dward

Source/iOS/App/DolphiniOS/UI/Emulation/EmulationiOSViewController.mm

@@ -427,12 +427,17 @@ - (void)takeScreenshot {
       return;
     }
 
-    UIImageWriteToSavedPhotosAlbum(image, self, @selector(screenshot:didFinishSavingWithError:contextInfo:), (__bridge void*)feedback);
+    // __bridge_retained: feedback is a local with nothing else holding it past this block's
+    // scope. A plain __bridge here would let ARC deallocate it before the async save actually
+    // completes, leaving screenshot:didFinishSavingWithError:contextInfo: reading a dangling
+    // pointer out of contextInfo (real use-after-free, not theoretical -- this fires on every
+    // screenshot). __bridge_transfer below hands ownership back and releases it.
+    UIImageWriteToSavedPhotosAlbum(image, self, @selector(screenshot:didFinishSavingWithError:contextInfo:), (__bridge_retained void*)feedback);
   }];
 }
 
 - (void)screenshot:(UIImage*)image didFinishSavingWithError:(NSError* _Nullable)error contextInfo:(void*)contextInfo {
-  UINotificationFeedbackGenerator* feedback = (__bridge UINotificationFeedbackGenerator*)contextInfo;
+  UINotificationFeedbackGenerator* feedback = (__bridge_transfer UINotificationFeedbackGenerator*)contextInfo;
 
   [feedback notificationOccurred:error == nil ? UINotificationFeedbackTypeSuccess : UINotificationFeedbackTypeError];
 }