Comprehensive bounds checking for all operations

Comprehensive addition of bounds checking to all cstruct operations (from @pqwy in #33). The major API-facing changes are:

• Disallow negative indexing with all cstruct accessors.
• Disallow negative sub and shift operations.
• Make sure of_bigarray cannot create invalid cstruct values.

This may break some older cstruct consumers that assumed that negative shifts were allowed, and so the version has been bumped to 1.4.0.