dd: avoid overflow converting a block count to bytes

[Angadi56]

skip= and seek= values given as block counts are converted to bytes in Num::to_bytes by multiplying the count by ibs/obs. The result is then checked against i64::MAX (GNU's intmax_t limit), but the multiply itself was unchecked, so the product can wrap around before the check ever sees it.

Repro:

dd skip=36028797018963968

That is 2^55 blocks. With the default ibs=512, the byte value is 2^55 * 512 == 2^64, which wraps to 0. A release build then skips nothing and continues silently; a debug build panics with "attempt to multiply with overflow".

The fix switches the multiply to saturating_mul, so an oversized count saturates to u64::MAX and the existing bound check rejects it with the usual "Value too large for defined data type" error. This keeps the u64::MAX-means-too-big convention the byte-size parser already uses, and matches calc_bsize, which already saturates the same multiply. calc_loop_bsize had the same unchecked rremain * ibs on the count= path, so it gets the same change.

Tests:

• a unit test in parseargs.rs checking that skip=/seek= block counts whose byte size overflows are rejected at parse time
• a CLI regression test in tests/by-util/test_dd.rs running dd skip=... / seek=... and checking for the error; it fails without the fix (panic in debug builds) and passes with it

[sylvestre]

the description is hard to read, please fix it

also, please add tests that reproduces the issue

[github-actions]

GNU testsuite comparison:

Skip an intermittent issue tests/date/date-locale-hour (fails in this run but passes in the 'main' branch)
Skip an intermittent issue tests/pr/bounded-memory (fails in this run but passes in the 'main' branch)
Congrats! The gnu test tests/expand/bounded-memory is now passing!
Congrats! The gnu test tests/rm/many-dir-entries-vs-OOM is now passing!

[Angadi56]

Done. Rewrote the description with a concrete repro, and added a CLI regression test in tests/by-util/test_dd.rs next to the existing overflow tests. It fails without the fix (debug builds panic on the multiply) and passes with it. The parseargs unit test covering the parse-time rejection was already in the diff.