Low: controller: handle malformed CIB diffs better

Static analysis wasn't happy we were dereferencing the result of
first_named_child(), which can theoretically be NULL (though not in practice).

Also, we were asserting that the XML element was of the expected type.

In both cases, now do a CRM_CHECK() so the controller ignores malformed CIB
diffs rather than crash.