strv: use realloc_multiply() to check for multiplication overflow

This could overflow on 32bit, where size_t is the same as unsigned.