In fsck_ffs pass1, prevent the inosused variable from wrapping.

The loop that scans the used inode map when soft updates is in use
assumes that the inosused variable is signed. However, ino_t is
unsigned, so the loop invariant is incorrect and the check for
inosused wrapping to < 0 can never be true.

Instead of checking for wrap after the fact just prevent it from
happening in the first place.

PR: 218592
Submitted by: Todd Miller <todd.miller@courtesan.com>
Reviewed by: mckusick
MFC after: 1 week