network: validate HTTP Content-Length on the client

[janry]

Sanitize content-length received from server. Trusting what comes on the wire produces nasty failure modes.

The HTTP client used for the announce-server list, the external-IP query, and the pakset downloader trusted the wire Content-Length:
parse via atol() into sint32, then `new char[length + 1]` plus `network_receive_data(..., length, ...)`.
Negative values gave a zero-byte allocation paired with a uint16-truncated read length of 0xFFFF -> OOB write.
INT32_MAX overflowed the signed `length+1` to a huge size_t and tripped uncaught bad_alloc.

Cheers, Jan