Reject negative counts in pack200 parseCPUTF8/SignatureReferences

[kali834x]

the int[] overloads of parseCPUTF8References and parseCPSignatureReferences in the pack200 bandset summed their per-entry counts with a plain loop and sized each sub-array straight from counts[i], unlike decodeBandInt, parseFlags and parseReferences which already route the total through sumNonNegative. a crafted archive whose code_LocalVariableTable_N, *_type_RS or anno_N band decodes to a negative count (unsigned5 is the default but a signed secondary codec can replace it for any band after the segment header) reaches new CPUTF8[-1] and throws NegativeArraySizeException out of ClassBands, escaping the declared Pack200Exception contract; the same unchecked sum can also wrap on large counts. route both through sumNonNegative so a corrupt band yields a normal Pack200Exception like the sibling overloads. follow-up to the sumNonNegative work in #782.

• Read the contribution guidelines for this project.
• Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
• I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
• Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

[garydgregory]

TY @kali834x , merged 🚀