demux: ogg: vorbis birates are signed.

Negative being meaningless.
codec: vorbis: birates are signed. (fix #10324)

Negative being meaningless.
demux: wav: stay within riff chunk boundaries (fix #10323)
Merge remote-tracking branch: upstream/master