#50 Make sure realloc() arguments never overflow

[Nick Mathewson]

Prompted by openbsd's preferred "calloc(m,n)" vs "malloc(m*n)", I
wanted to define a variant of realloc(p,m*n) that would make sure m*n
didn't overflow. I added one to util-internal.h, and made sure we
used it everywhere.

I've also added an EVUTIL_SAFE_DOUBLE macro to test for integer
overflow during the common 'double the size and realloc' pattern, and
updated ht-internal.h to check for overflow in its allocations.

[Nick Mathewson]