Skip cidr checking for bans with negative or too large cidrlen.

Upto some length, such bans could match the exact IP address.

Obtained from: ircd-ratbox (androsyn)
Also restrict cidrlen for testmask/masktrace (match_ips()).
Skip cidr checking for hostmask.c entries with negative cidrlen.

They will be treated as hostmasks only. In the case of dlines they will
be rejected as invalid.

hostmask.c entries such as dlines, klines and auth blocks can only be
added by opers or via ircd.conf.