Bounds everywhere

Comprehensively deal with bounds.

Changes:
* Disallow negative indexing with all accessors;
* Disallow negative `sub` and `shift`; and
* Make sure `of_bigarray` can't create invalid `cstruct`s.

Taken together, these ensure subview-confinement in a `cstruct`: it is impossible to read/write data outside of a view, and it is impossible to widen a view. The new property is that a `cstruct` can only ever contain valid `off` and `len` fields (that is, smaller than the corresponding buffer), provided constructing functions are correct, since the type is `private`.

The changes are slightly incompatible, but at least `mirage-www` in direct mode and a `tls` demo rig work with them.

Performance-related PR to come on top.