upstream: fix integer overflow in XMSS private key parsing.

Reported by Adam Zabrocki via SecuriTeam's SSH program.

Note that this code is experimental and not compiled by default.

ok markus@

OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1
