core: Fix size_hint for signed integer Range<T> iterators

core: Fix size_hint for signed integer Range<T> iterators

There was an overflow bug in .size_hint() for signed iterators, which
produced an hilariously incorrect size or an overflow panic.

Incorrect size is a serious bug since the iterators are marked
ExactSizeIterator. (And leads to abort() on (-1i8..127).collect() when
the collection tries to preallocate too much).

All signed range iterators were affected.

> (-1i8..127).size_hint()
(18446744073709551488, Some(18446744073709551488))

Bug found using quickcheck.

Fixes #24851