Use safe-math in xcm buy_weight impl

[ghzlatarev]

Description

• This was not going to happen with current values but just in case for future additions we protect against accidental overflows.
• The division is impossible to underflow because the dividend will be saturated to the max value of u128. And u128::Max can be divided by the second smallest u128 number.
• A divide by zero is possible but we can assert that WEIGHT_PER_SECOND is never 0 with an integration test.

---

Before we can approve this PR for merge, please make sure that all the following items have been checked off:

• Connected to an issue with discussion and accepted design using zenhub "Connect issue" button below
• Added one label out of the L- group to this PR
• Added one or more labels from the A- and C- groups to this PR
• Explicitly labelled A-calamari, A-dolphin and/or A-manta if your changes are meant for/impact either of these (CI depends on it)
• Re-reviewed Files changed in the Github PR explorer.

Situational Notes:

• If adding functionality, write unit tests!
• If importing a new pallet, choose a proper module index for it, and allow it in BaseFilter. Ensure every extrinsic works from front-end. If there's corresponding tool, ensure both work for each other.
• If needed, update our Javascript/Typescript APIs. These APIs are officially used by exchanges or community developers.
• If modifying existing runtime storage items, make sure to implement storage migrations for the runtime and test them with try-runtime. This includes migrations inherited from upstream changes, and you can search the diffs for modifications of #[pallet::storage] items to check for any.

[github-actions]

⚠️ Congestion test: 1-day congestion cost (calamari) is NOT above target_daily_congestion_cost_kma

[ferrell-code]

one comment fine as is

[Garandor]

this division can't overflow, so it's fine as is

[ferrell-code]

Good point, why does saturating_div even exist?

[Garandor]

Good point, why does saturating_div even exist?

Dividing by a float [0,1) increases the value so it can overflow in the positive direction which is handled by saturating...
on signed types it can also overflow in the negative direction in the same way.
Also, division-by-zero is a panic condition.
Georgi uses a u128 type and checks for nonzero of the divisor in the integration test, so for these inputs saturating_div and / have identical semantics