asan: heap buffer overflow in mmo_scan

mmo_get_loc needs to handle arbitrary vma and size chunks.  Fuzzers
found that it wasn't working so well when the end of chunks were
getting close to address wrap-around.

	* mmo.c (mmo_get_loc): Make "size" unsigned.  Avoid arithmetic
	overflow when calculating whether range hits an existing chunk.