--max-time accepts 0 and negative values without validation

[korya]

Problem

--max-time is converted straight to a duration and handed to http.Client.Timeout, where any value <= 0 means no timeout at all.

Reproduction

$ http-assert -m 0 --assert-ok http://127.0.0.1:8791/ok
[+] PASSED       ← no timeout applied

$ http-assert -m -5 --assert-ok http://127.0.0.1:8791/ok
[+] PASSED       ← no timeout applied

Why it matters

A user typing -m 0 most likely means "fail immediately", and a script computing a deadline that goes negative silently gets an unbounded request — the opposite of the intent, and a hang in CI.

Suggested fix

Reject negative values as an invalid argument. Either reject 0 too, or document explicitly that 0 disables the timeout (curl's convention).