Module function arg counts are ptrdiff_t, not int

Module function arg counts are ptrdiff_t, not int

* src/emacs-module.c (struct module_fun_env)
(module_make_function, module_funcall, Fmodule_call):
* src/emacs-module.h (struct emacs_runtime, struct emacs_env_25):
Use ptrdiff_t, not int, for arg counts.
* src/emacs-module.c (module_make_function): Don’t bother
checking arity against MOST_POSITIVE_FIXNUM, as that’s
unnecessary here.  Make the checking clearer by negating it.
(module_make_function, Fmodule_call): No need to use xzalloc
since the storage doesn’t need to be cleared.
(module_funcall): Don’t use VLA, since C11 doesn’t guarantee support
for it, and many implementations are buggy with large VLAs anyway.
Use SAFE_ALLOCA_LISP instead.
(module_vec_set): Don’t crash if i < 0.
(module_vec_get): Don’t crash if i < MOST_NEGATIVE_FIXNUM.
(module_vec_set, module_vec_get): Do fixnum checks only when
i is out of array bounds, for efficiency in the usual case.
(Fmodule_load): Simplify fixnum range check.
(Fmodule_call): Simplify arity check.  Use xnmalloc to detect
integer overflow in array allocation size.