fix(dstack-util): reject a LUKS keyslot area whose end overflows

[kvinwang]

Problem

validate_single_luks2_header checks that the keyslot binary area sits between the header copies and the payload, using area.offset() + area.size() > PAYLOAD_OFFSET. Both values come from the host-supplied on-disk header. In release (overflow checks off) a huge size wraps the sum under PAYLOAD_OFFSET and the header is accepted; in debug it panics. This runs on every boot with an existing encrypted data disk.

$ cargo test --release -p dstack-util test_validate_luks2_header
called `Result::unwrap_err()` on an `Ok` value: ()

Fix

Use checked_add; a sum that overflows is out of range. A regression test patches both header copies of the luks_header_good fixture with an overflowing size. The existing out-of-range test now uses the same patch helper.

Verification

cargo test -p dstack-util (109 passed, passes in debug and release), clippy and fmt clean.