Reject invalid bit counts in pack APIs

[soul-sol]

Reject invalid signed bit counts before doing pointer or size arithmetic in the pack APIs.

Without these checks:

• oggpack_writetrunc(..., -8) dereferences one byte before the heap buffer.
• oggpack_writecopy(..., -8) reaches memmove with a negative size converted to size_t.
• oggpack_adv(..., -8) moves the read pointer before its buffer.
• sufficiently large positive counts can overflow intermediate additions.

The invalid inputs now put the pack buffer into the same error state used by existing invalid-count and overflow paths. Truncation also rejects a target beyond the number of bits already written. The self-test covers both bit orders.

Validation:

• make check with GCC, -Wall -Wextra -Werror
• make check with Clang ASan+UBSan
• targeted ASan repros fail on the base revision and exit cleanly with this patch