sh: Fix some arithmetic undefined behaviour.

Fix shifts of possibly negative numbers found with ubsan and avoid signed
integer overflow when hashing an extremely long command name.

MFC after: 1 week