Refactor: fencer, libstonithd: Bounds-check stonith-watchdog-timeout

There may be cases that aren't technically correct (especially in
conjunction with very large SBD_WATCHDOG_TIMEOUT values) -- but with
timeout values higher than INT_MAX, there's no practical relevance. A
timeout of INT_MAX milliseconds is over three weeks if I did the math
correctly.

The most important thing is to avoid overflow to negative values in
configurations with unreasonably large timeouts.

Signed-off-by: Reid Wahl <nrwahl@protonmail.com>