MathUtil: Add SaturatingCast to cast floats more safely

[leoetlino]

A modified version of #8871 with the clamp function added to MathUtil along with tests.

The second commit makes VertexLoaderTest use it in order to avoid undefined behavior:

A prvalue of a floating-point type can be converted to a prvalue of
an integer type. The conversion truncates; that is, the fractional
part is discarded. The behavior is undefined if the truncated value
cannot be represented in the destination type. ([conv.fpint]/1)

[JosJuice]

Could you remove this in favor of the new SaturatingCast?

dolphin/Source/Core/DiscIO/WIACompression.cpp

Lines 169 to 172 in 3e66db2

	constexpr auto clamped_cast = [](size_t x) {
	return static_cast<unsigned int>(
	std::min<size_t>(std::numeric_limits<unsigned int>().max(), x));
	};

[leoetlino]

@JosJuice Done. The tests also pass now; apparently using std::clamp was not a good idea because it forces value, lo and hi to be the same type T and converting lo/hi to T can already result in overflow.

[Dentomologist]

SaturatingCast<unsigned int>(-1)

returns 4294967295 instead of 0, which I don't think is intended.

[sepalani]

@Dentomologist
You're right and this should produce a compiler warning signed/unsigned mismatch. Maybe a static_assert can be added to prevent edgy cases like that.

[Pokechu22]

I feel like there should be a static_assert(lo == 0) or something like that here.

[leoetlino]

Or perhaps replace return lo; with return 0;? What do you think would be clearer?

[Pokechu22]

I personally think the static_assert would be clearer, since it makes the u32(...) < 0 assumption more explicit.

[leoetlino]

Works for me