Before this commit calling `Reader.finish` a 2nd time would return a
random, accidental error (`UnexpectedEof`), because of how
`StreamingDecoder`'s `state` is set after processing the `IEND` chunk.
After this commit, `Reader.finish` will handle this condition
explicitly, in a similar same way to how `next_frame` handles being
called when we have already consumed all the frames.

After a recent commit, all public APIs of a `Reader` take care of not
going beyond the `IEND` chunk and returning `PolledAfterEndOfImage`
instead.  This means that tracking `at_eof` at the level of
`ReadDecoder` is obsolete and leads to unnecessary complexity.  This
commit refactors away this complexity.

`ReadDecoder::finish_decoding` now reuses `decode_next` instead of
duplicating some of its code.  Some duplication (e.g. handling of
`Decoded::Nothing` remains - this will be taken care of in a subsequent
commit).

This commit means that `decode_next` can be a private method of
`ReadDecoder` (this is not enforced yet, before a subsequent commit
moves `ReadDecoder` into a separate `mod`ule).

Before this commit `fn decode_next` would `loop` to skip
`Decoded::Nothing` events.  This is unnecessary, because all the callers
of `decode_next` already account for `Decoded::Nothing` (explicitly or
implicitly via a wildcard).

This commit helps to keep some aspects of `ReadDecoder` private
(e.g. its fields, `decode_next` methods, etc.).  This commit
also means that `mod.rs` no longer directly depends on `Decoded`
nor `StreamingDecoder`.