Refactor: libcrmcommon: Bounds-check crm_get_msec()

Everywhere except watchdog.c. That requires enough changes to get its
own commit.

There may be cases that aren't technically correct, but with timeout
values higher than INT_MAX, there's no practical relevance. A timeout of
INT_MAX milliseconds is over three weeks if I did the math correctly.

The most important thing is to avoid overflow to negative values in
configurations with unreasonably large timeouts.

Signed-off-by: Reid Wahl <nrwahl@protonmail.com>