Clamp rather than overflow on child indexes when we get to the

end of the UINT_MAX items we can support.

Found by adding a lot of asserts and brute force testing, both
of which I have left in.

Fixes 	#967

May also be relevant to #827

bin/varnishd/cache_expire.c

@@ -182,6 +182,8 @@ exp_insert(struct objcore *oc, struct lru *lru)
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 	CHECK_OBJ_NOTNULL(lru, LRU_MAGIC);
 
+	Lck_AssertHeld(&lru->mtx);
+	Lck_AssertHeld(&exp_mtx);
 	assert(oc->timer_idx == BINHEAP_NOIDX);
 	binheap_insert(exp_heap, oc);
 	assert(oc->timer_idx != BINHEAP_NOIDX);