Add integer overflow checks to URL escape allocation functions

[kodareef5]

ap_escape_path_segment, ap_os_escape_path, and ap_escape_urlencoded in server/util.c allocate output buffers using 3 * strlen(input) + constant without checking for integer overflow. On platforms where size_t is 32-bit, inputs exceeding ~1.33GB cause the multiplication to wrap, resulting in undersized allocation.

The HTML escape function ap_escape_html2 in the same file already has overflow protection at line 2148:

if (i + j > APR_SIZE_MAX - 6) {
    abort();
}

This applies the same pattern to the three URL escape functions for consistency. Each now checks len > (APR_SIZE_MAX - constant) / 3 before the multiplication, calling abort() on overflow.