Prevent integer overflow in safepower_agent ValidateBootCountCondition

`BootState::boot_counter` is a `uint32` proto field, while `ValidateBootCountCondition` assigns `boot_counter` to a signed `int` and adds `boot` / `max_boots` without bounds checking, which could cause signed integer overflow (Undefined Behavior) near `INT_MAX` or wrap around modulo 2^32 near `UINT32_MAX`.

Update `ValidateBootCountCondition` to bound both `max_boots` (`[1, kMaxBootCount]`) and `boot_state->boot_counter()` (`<= kMaxBootCount`, where `kMaxBootCount = 1'000'000'000` represents ~31 years of 1-second reboots) so `current_boot_count + max_boots` always fits safely within a standard signed `int`.

PiperOrigin-RevId: 988326544
Change-Id: I8f88c275c8c9f6598a14f6adc83eec25fa0c3ca0