bspatch: add sanity checks on sizes to avoid integer overflow

Note that this introduces an explicit 2GB limit, but this was already
implicit in variable and function argument types.

This is based on the "non-cryptanalytic attacks against freebsd
update components" anonymous gist. Further refinement is planned.

Reviewed by: allanjude, cem, kib
Obtained from: anonymous gist
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D7619