ng_parse: Add upper bound to avoid possible overflow

Also move num initialization for clarity.

We still need to check num in ng_unparse_composite (reported by des@ in
D52151) but this is another incremental improvement in netgraph input
validation.

Reviewed by: des
PR: 267334
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52151

(cherry picked from commit 375527545c85362f14070d35575f9bcd7092f4b9)
(cherry picked from commit 4407e10fdc8b969775233d47c05559c2601b60f4)