cmp: use checked subtraction for the verbose offset padding

[MsfPablo]

Fixes #265.

The --print-bytes branch of format_verbose_difference already pads with saturating_sub; the --verbose branch a few lines down uses a plain -. Since offset_width comes from the smaller file's metadata length, a file that reports length 0 but still yields bytes collapses it to 2, and the subtraction underflows as soon as the running offset reaches three digits.

$ printf '\377%.0s' {1..150} > nz
$ cmp --verbose /dev/zero nz

Before, that stops after byte 99 (abort under overflow-checks, a huge padding loop otherwise). After, all 150 lines print and it exits 1.

Made the two branches match rather than adding a separate guard.

Worth flagging since the issue shows GNU's output: the column is still narrower than GNU's here, because offset_width is derived from a metadata length that is 0 for this kind of file. That is the same root input, but it is a formatting difference rather than a crash, so I have left it out of this change.

Tests: an integration test covering the case, gated to unix for /dev/zero.

[github-actions]

GNU diffutils testsuite comparison:

Test results comparison:
  Current:   TOTAL: 0 / PASSED: 0 / FAILED: 0 / SKIPPED: 0
  Reference: TOTAL: 33 / PASSED: 8 / FAILED: 21 / SKIPPED: 4

Changes from main branch:
  TOTAL: -33
  PASSED: -8
  FAILED: -21

Test improvements (21):
  + binary
  + colliding-file-names
  + colors
  + empty-file
  + excess-slash
  + expand-tabs
  + filename-quoting
  + function-line-vs-leading-space
  + ifdef
  + ignore-case
  + ignore-matching-lines
  + ignore-tab-expansion
  + invalid-re
  + label-vs-func
  + new-file
  + no-dereference
  + no-newline-at-eof
  + side-by-side
  + side-by-side-seq
  + starting-file
  + stdin