hevc: Use get_bits_long() in decode_vui()

Fix assertion failure.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

(cherry picked from commit 920c01adce6c273fc043513ff237a6266e612152)
hevc: use av_mallocz() for allocating tab_ipm

Fixes use of uninitialized memory and out of stack array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

(cherry picked from commit 6cc94e971933cd38c452172bb048bf760e65cc3e)
hevc: Do not turn 32bit timebases into negative numbers

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ed06e5d92b4c67b49068d538461fbbe0a53a8c5e)
hevc: make pps/sps ids unsigned where necessary

Fixes integer overflow and out of array accesses.
Found-by: Mateusz j00ru Jurczyk and Gynvael Coldwind

(cherry picked from commit 4d33873c2990b8d6096f60fef384f0efc4482b55)