Fix buffer overflow in hash_pbkdf2() with a large output length

[lazerg]

hash_pbkdf2() sizes the digest buffer with ceil((float) length / 2.0) and the block count with ceil((float) digest_length / (float) ops->digest_size). A float carries 24 bits of mantissa, so past 2^24 the conversion rounds and both counts come out wrong: rounding up makes zend_bin2hex() write past the end of the return string, rounding down leaves the tail of the string uninitialized. hash_pbkdf2('md5', 'password', 'salt', 1, 268435473) writes 8 bytes out of bounds under ASAN.

Both counts are exact in integer arithmetic, so this replaces them with round-up divisions. <math.h> had no other user in the file.

This came out of #23377. The odd length case reported there is fine on its own, as Sjord noted before closing it: zend_string_alloc(length) reserves length + 1 bytes and 2 * ceil(length / 2) == length + 1, so the extra hexit lands on the terminator byte that gets overwritten a line later. The float conversion on those same two lines is a real overflow though.