Reject invalid byte counts in sync APIs

[soul-sol]

Reject negative byte counts before they can corrupt ogg_sync_state accounting.

ogg_sync_wrote(oy, -1) currently decrements oy->fill and reports success. The next ogg_sync_buffer() then returns a pointer one byte before the allocation, so an ordinary caller write becomes a heap-buffer-overflow. The existing addition-based capacity check can also overflow for a sufficiently large positive count.

This change uses a subtraction-based capacity check, rejects negative writes without mutating state, and makes ogg_sync_buffer() reject negative requested sizes. The framing self-test verifies the error returns and unchanged fill position.

Validation:

• make check with GCC, -Wall -Wextra -Werror
• make check with Clang ASan+UBSan
• targeted ASan repro fails one byte before the heap allocation on the base revision and exits cleanly after the fix