ParseNumber: signed overflow when a fraction carries ~2 billion leading zeros

ParseNumber() has two signed-overflow UB sites:

1. --expFrac in the fraction loop, once per digit, with no cap.
2. int maxExp = 308 - expFrac;

An all-zeros fraction leaves significandDigit at 0, so --expFrac runs on every digit. At 2,147,483,340 fraction digits expFrac passes -(INT_MAX-308) and both sites overflow.

Repro (UBSan, -fno-sanitize-recover): parse "0." + 2147483340×'0' + "1e5".

reader.h:1706 runtime error: signed integer overflow: 308 - -2147483341 cannot be represented in type 'int'