opts: reject CPU counts that do not fit in int64

[SashaMIT]

Summary

ParseCPUs turns a CPU count into nano-CPUs (n * 1e9) and then calls big.Int.Int64. That call keeps the low 64 bits. ParseCPUs("10000000000") returned -8446744073709551616 and a nil error. 9223372036.854775808 (2^63 nano-CPUs) came back as math.MinInt64.

Values that fit still parse. 9223372036.854775807 is math.MaxInt64. -9223372036.854775808 is math.MinInt64. One nano-CPU past either end now returns value is out of range.

docker run --cpus, docker update --cpus, service CPU limits, and Compose cpus all go through this function.

Release notes

- Reject `--cpus` values that do not fit in an int64.

Drafted with Grok 4.7. The code has not yet been reviewed by a human.