fix: validate CIDR prefix lengths in match

[fasrm]

## Summary

match() did not validate CIDR prefix lengths before passing them to matchCIDR().

Invalid values could therefore produce unexpected behavior:

- negative values and NaN could result in an unconditional match;

- fractional prefix lengths were accepted with inconsistent matching semantics;

- values above the IPv4/IPv6 prefix range were not rejected;

- Infinity could cause non-termination for certain inputs.

This also affected subnetMatch(), since it delegates CIDR comparisons to match().

## Fix

Validate that cidrBits is:

- an integer;

- greater than or equal to 0;

- less than or equal to the address bit length (32 for IPv4 and 128 for IPv6).

Invalid prefix lengths now throw:

ipaddr: invalid CIDR prefix length

## Tests

Added regression tests covering invalid CIDR prefix lengths for:

- IPv4 match();

- IPv6 match();

- subnetMatch().

The full test suite passes:

70 tests

70 pass

0 fail

[whitequark]

Looks OK. Please reformat the tests to make them more readable, like the rest of the file.

[fasrm]

Reformatted the tests for readability and consistency with the rest of the test suite. All 70 tests are passing.