If indent * nest depth is large enough to overflow an int, it causes the
required output buffer size to be underestimated leading to a buffer
overflow.

The offending arithmetic is upgraded to a ptrdiff_t and indent is
artificially capped. An overflow is still technically possible given a
high enough recursion depth but not without first consuming petabytes of
RAM.

If indent is negative, it causes a size_t to underflow to some number a
little bellow size_t max. If that underflow isn't accidentally rectified
by a subsequent overflow (if -indent * (nest_depth + 1) >
current_buffer_size) then the buffer up-sizer gets stuck in an infinite
loop trying to find a power of two that fits in a size_t but is greater
that size_t max / 2.

It's hard to tell if `ujson.dumps(..., indent=-1)` was ever an
intentional feature but I don't feel comfortable breaking it in a
security fix. For now, the dubious *any negative indent -> pad colons
but add no indentation or newlines* behaviour is preserved but
internally the indent is clipped to -1 and all subsequent indentation
code paths are skipped over.