WIP: checked integer conversions

This is not done yet but ready for discussion at least.

1. fixes #3759, making arithmetic type-preserving
1. fixes #5413, checking integer truncations
1. also checks signed<->unsigned conversions

(1) was simple and did not really break much.
(2) was a bit more breaking, but not too bad and leads to clearer code in most cases.
(3) was kind of a disaster and seems to be very annoying.

The problem with (3) is that interpreting a 2's complement integer as unsigned is mathematically useful. It also comes up a lot in hashing, random number generation, and when you just want to write a byte to an IO stream.

I'm not sure yet how to rewrite https://github.com/JuliaLang/julia/blob/ec607da4d3b25663487dd8c5e773d661b6bb6054/base/random.jl#L209 with checked integer conversions. We need to decide how to handle cases like this.

I think adding these checks is clearly the right thing, but I was surprised at how many legitimate uses of "unsafe" integer conversion there were. I added methods to `itrunc` for unsafely truncating integers, but this only handles converting from larger to smaller. We need to figure out what other functions might be needed.
convert would throw an error if `x < 0`