bplist: reject object lengths that overflow the parser's bounds checks (#90)

The binary plist parser reads an untrusted element/byte count for data,
string, array and dictionary objects and then feeds it into length
arithmetic (start+length, length*2, count*objectRefSize) before its
range checks. A crafted count near 2^64 makes that arithmetic wrap back
into range, so the checks pass and the parser panics in the subsequent
make()/slice instead of returning an error.

Reject counts larger than the number of bytes preceding the offset table
at the point they are parsed; a valid object can never be that large.