Fix return-by-reference vulnerability in QM_Vector3Reflect (#37)

#### Potential fix for alerts ####
* [Returning stack-allocated
memory](https://github.com/PolyhedronStudio/Q2RTXPerimental/security/code-scanning/5)

## Summary

`QM_Vector3Reflect` was returning a reference to a stack-allocated local
variable, creating a dangling reference vulnerability.

## Changes

- **inc/shared/math/qm_vector3.h**: Changed return type from `Vector3 &`
to `Vector3` (return by value)

```cpp
// Before
QM_API_CONSTEXPR Vector3 &QM_Vector3Reflect( const Vector3 &v, const Vector3 &normal ) {
    Vector3 result = { 0.f, 0.f, 0.f };
    // ... computation ...
    return result;  // Dangling reference
}

// After
QM_API_CONSTEXPR Vector3 QM_Vector3Reflect( const Vector3 &v, const Vector3 &normal ) {
    Vector3 result = { 0.f, 0.f, 0.f };
    // ... computation ...
    return result;  // Safe return by value
}
```

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

Author: WatIsDeze

inc/shared/math/qm_vector3.h

@@ -466,7 +466,7 @@ QM_API Vector3 QM_Vector3Lerp( const Vector3 &v1, const Vector3 &v2, const float
 }
 
 // Calculate reflected vector to normal
-QM_API_CONSTEXPR Vector3 &QM_Vector3Reflect( const Vector3 &v, const Vector3 &normal ) {
+QM_API_CONSTEXPR Vector3 QM_Vector3Reflect( const Vector3 &v, const Vector3 &normal ) {
     Vector3 result = { 0.f, 0.f, 0.f };
 
     // I is the original vector