Clamp values to [-1,1] before calling acos.

I ran into a problem where `camera.tilt` would occasionally be `NaN`, causing the camera's direction to be `NaN` and the scene's near/far planes to be NaN.  I traced the problem (I'm pretty sure - it happened rarely enough that debugging was a challenge) back to a dot product being very slightly greater than 1, causing its `acos` to be `NaN`.  This change adds a `CesiumMath.acosClamped` that clamps its value to the valid range before passing it to acos, and changes every place in Cesium that wasn't already handling this possibility to use this wrapper.  For completeness I added an `asin` wrapper, too, though we don't use it anywhere.