Fix off-by-one error in fsck_ffs(8) chkrange() block-number check.

Fix off-by-one error in fsck_ffs(8) chkrange() block-number check.

On an amd64-CURRENT machine with an i-node that refers to a block
number that is one too large will cause a core dump, due to writing
beyond the end of blockmap[] and corrupting the next heap block,
which happens to contain a struct inoinfo in inphash[]. Note that
valgrind catches the blockmap[] access.

Reported by:  Robert Morris
PR:           271289
MFC after:    1 week
Sponsored by: The FreeBSD Foundation