Reject invalid bit counts in pack APIs

[soul-sol]

Reject invalid signed bit counts before doing pointer or size arithmetic in the pack APIs.

Without these checks:

• oggpack_writetrunc(..., -8) dereferences one byte before the heap buffer.
• oggpack_writecopy(..., -8) reaches memmove with a negative size converted to size_t.
• oggpack_adv(..., -8) moves the read pointer before its buffer.
• sufficiently large positive counts can overflow intermediate additions.

The invalid inputs now put the pack buffer into the same error state used by existing invalid-count and overflow paths. Truncation also rejects a target beyond the number of bits already written. The self-test covers both bit orders.

Validation:

• make check with GCC, -Wall -Wextra -Werror
• make check with Clang ASan+UBSan
• targeted ASan repros fail on the base revision and exit cleanly with this patch

[mcc0nnell]

I found one remaining signed-overflow boundary in the current head (cbd97b5). The new guard prevents overflow in bits + b->endbit, but the later byte-rounding expression still evaluates bits + 7 in int.

A minimal UBSan reproducer is:

unsigned char data = 0;
oggpack_buffer b;
oggpack_readinit(&b, &data, 1);
b.endbit = 7;
oggpack_adv(&b, INT_MAX - 7);

On cbd97b5, UBSan reports signed integer overflow at the (bits + 7) >> 3 expression.

I tested a narrow fix that computes the combined advance in ogg_int64_t before rounding and pointer/accounting updates, with the same boundary covered in both LSb and MSb self-tests. The focused follow-up is signed locally as b34f73fdebcf07287d174a3f51f02f49b97081bb; sanitizer tests and make check are clean.