bitwise: reject invalid bit counts before pointer arithmetic

[mcc0nnell]

Reject invalid bit counts before they can participate in pointer or size arithmetic in the bit-packing helpers.

Without these checks:

• oggpack_writetrunc(..., -8) moves the write pointer one byte before the allocated buffer and triggers an ASan heap-buffer-overflow.
• oggpack_writecopy(..., -8) passes a negative byte count to memmove(), reported by ASan as negative-size-param.
• oggpack_adv(..., -8) moves the read pointer before the input buffer; the next read triggers an ASan buffer underflow.
• An unaligned oggpack_writecopy(..., LONG_MAX) overflows b->endbit + bits, reported by UBSan as signed integer overflow.

The change rejects negative truncation/copy/advance counts, prevents overflow while sizing write-copy storage, and treats attempts to truncate past the current write position as invalid. It applies the same behavior to the MSb variants.

Regression coverage exercises the invalid-count paths in the built-in bitwise self-test.

Validation:

• built-in bitwise self-test under ASan + UBSan: pass
• standalone repros for negative trunc/copy/advance and LONG_MAX writecopy: pass after fix
• -Wall -Wextra -Werror self-test build: pass