Fix support for arrays of signed ints

If `Buffer._useTypedArrays` is `false`, the current implementation will directly copy the contents of an `Arrayish` object into `buf` inside the `Buffer` constructor.
In most cases, this is acceptable behaviour, however this will cause disastrous results if a negative integer is passed.

For example, using `new Buffer([-1, -1, -1]).toString('hex')` will output the hex: `0-10-10-1`.

This occurs in Firefox (all release versions) simply because typed arrays do not support mutable properties (this is fixed in Firefox 30).